Large-Scale Exposure Of Orphaned Commits On Major Git Platforms
summary
Large-scale scan across GitHub GitLab and Bitbucket uses the GitHub event API plus a five-year historical dataset to map commits; engineering runs commit and secret scanning on an Elastic cluster spread over 20 nodes with internal regexes. From ~5.4 billion commits the analysis flags 66 million dangling commits and extracts ~600k secrets (API keys, AWS/GCP tokens, Docker/Hub tokens); filter-repo and BFG cleaners do not fully purge remote dangling commits and platforms require manual removal or repo deletion.
AI-written summary · about
chapters (9)
- 0:00Introduction to research
- 1:09What are dangling commits
- 4:01Git platforms and dangling commits
- 7:18Why GitHub for research
- 10:09Engineering behind study
- 11:12Real impact of dangling commits
- 14:52Mitigation and prevention
- 17:22Developer awareness and training
- 18:06Q&A session
related talks
48mHow Source Code is Revealing our Secrets
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
30mCredential mitigation in large-scale organizations
15mStop Committing Your Secrets - Git Hooks To The Rescue!
17mIs My (Open Source) Project Safe?
33mGaining initial access by exploiting leaked credentials
30mWhoops! I Accidentally Leaked My Credentials (again)
39mApisecure, 14 & 15 March 2023 - Jose Palafox, Director of Business Development at GitHub.