<story><title>How a bug in VS2015 exposed my source code on GitHub and cost me $6,500</title><url>https://www.humankode.com/security/how-a-bug-in-visual-studio-2015-exposed-my-source-code-on-github-and-cost-me-6500-in-a-few-hours</url></story><parent_chain><item><author>Analemma_</author><text>This is becoming such a common story that I&amp;#x27;m starting to think it&amp;#x27;s a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to follow up.&lt;p&gt;Same thing with GitHub. When they see an AWS key, they need to block that push and send back a message saying &amp;quot;If you&amp;#x27;re really, really, REALLY sure you want to do this, add .allowawskey at the root of your commit and push again&amp;quot;. There&amp;#x27;s no excuse for letting people shoot themselves in the foot like this over and over.&lt;p&gt;(Edited for typo)</text></item></parent_chain><comment><author>Alupis</author><text>Is it really on the web service companies to make sure you (the developer) don&amp;#x27;t do anything stupid?&lt;p&gt;The article author could have avoided a lot of headache if he simply checked the repo before walking away. Red flags should have gone up as soon as he received the first weird Amazon messages, but he still didn&amp;#x27;t think to check his own work.&lt;p&gt;The author calls this a &amp;quot;Data Breach&amp;quot; but in reality it was a &amp;quot;Data Leak&amp;quot;.</text></comment>
<story><title>How a bug in VS2015 exposed my source code on GitHub and cost me $6,500</title><url>https://www.humankode.com/security/how-a-bug-in-visual-studio-2015-exposed-my-source-code-on-github-and-cost-me-6500-in-a-few-hours</url></story><parent_chain><item><author>Analemma_</author><text>This is becoming such a common story that I&amp;#x27;m starting to think it&amp;#x27;s a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to follow up.&lt;p&gt;Same thing with GitHub. When they see an AWS key, they need to block that push and send back a message saying &amp;quot;If you&amp;#x27;re really, really, REALLY sure you want to do this, add .allowawskey at the root of your commit and push again&amp;quot;. There&amp;#x27;s no excuse for letting people shoot themselves in the foot like this over and over.&lt;p&gt;(Edited for typo)</text></item></parent_chain><comment><author>kylec</author><text>This is a really good point. There was another post recently linking to a search for id_rsa files (SSH private keys) on GitHub. Instead of allowing people to publish sensitive things like that accidentally, GitHub really should require an extra confirmation.</text></comment>