How Segment proactively protects customer’s API keys
summary
Segment changes token format to an SGP prefix so secret scanners can match reliably, enrolls in GitHub/GitLab secret‑scanning partner programs, and runs a TypeScript Express /revoke endpoint that verifies GitHub signatures, validates tokens against internal APIs, then Auto revokes exposed keys. Revocations appear in the system in about 10 seconds with email notifications ~30s later; early rollout revoked three leaked tokens in the first month. Orphan token scans send orphan token alerts (25% deleted after first email), and tokens are stored hashed with a six‑char identifier.
AI-written summary · about
chapters (5)
related talks
39mApisecure, 14 & 15 March 2023 - Jose Palafox, Director of Business Development at GitHub.
27mBulletproof Shoes
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
26mIntro: Auth SIG
49mProtect Your Code with GitHub Security Features
01h 02mDeveloping secure software with GitHub
17mPreventing unauth'd credential access on GitHub using AWS services
23mSecuring the npm Ecosystem