Apisecure, 14 & 15 March 2023 - Jose Palafox, Director of Business Development at GitHub.
summary
GitHub reports running secret scanning across public and private repos, detecting millions of leaked tokens as the platform reaches 100 million developers. A leaked AWS key in testing attracts 17 use attempts within one hour and racks up about $81 in downstream charges. Push protection blocks commits in under a second, yields <1% false positives, and complements a partner program that adds regex patterns, token prefixes and a 32‑bit checksum plus a webhook payload to automate revocation — free to enroll.
AI-written summary · about
chapters (21)
- 0:00Securing API credentials
- 1:15GitHub secret scanning
- 3:19Impact of 100 million developers on secret leaks
- 4:47Human error causes leaks
- 6:11API token leak trends
- 7:16Where secrets leak
- 8:21Impact of leaked credentials
- 9:47Detecting secrets in repos
- 11:37AWS token leak case
- 13:45Alert fatigue solutions
- 14:28Reducing false positives
- 16:57Remediation steps
- 18:02GitHub push protection
- 19:49Push protection in IDEs
- 22:16API security partner program
- 24:25Token generation best practices
- 27:15Enrolling in partner program
- 29:21Q&A
- 33:31GitHub threat matrix
- 36:20Combating alert fatigue
- 38:47Closing remarks
related talks
17mPreventing unauth'd credential access on GitHub using AWS services
01h 02mDeveloping secure software with GitHub
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
24mHow to Find if Your Developers are Leaking Secrets?
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
33mGaining initial access by exploiting leaked credentials
49mProtect Your Code with GitHub Security Features
46mShip-It safely with GitHub Advanced Security