<story><title>Toyota suffered a data breach by accidentally exposing a secret key on GitHub</title><url>https://blog.gitguardian.com/toyota-accidently-exposed-a-secret-key-publicly-on-github-for-five-years/</url></story><parent_chain><item><author>fiddlerwoaroof</author><text>I wish I could set this up to block pushes proactively instead of reacting to pushed secrets.</text></item><item><author>greysteil</author><text>GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;docs.github.com&amp;#x2F;en&amp;#x2F;code-security&amp;#x2F;secret-scanning&amp;#x2F;secret-scanning-patterns#supported-secrets-for-partner-patterns&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;docs.github.com&amp;#x2F;en&amp;#x2F;code-security&amp;#x2F;secret-scanning&amp;#x2F;sec...&lt;/a&gt;</text></item><item><author>Natsukvshii</author><text>I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it.&lt;p&gt;I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.</text></item><item><author>danielodievich</author><text>Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose&amp;#x27;s support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn&amp;#x27;t have checked it in. I thought that was very proactive and excellent customer service.</text></item></parent_chain><comment><author>iancarroll</author><text>This exists on GitHub but is not free.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;docs.github.com&amp;#x2F;en&amp;#x2F;enterprise-cloud@latest&amp;#x2F;code-security&amp;#x2F;secret-scanning&amp;#x2F;protecting-pushes-with-secret-scanning#using-secret-scanning-as-a-push-protection-from-the-command-line&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;docs.github.com&amp;#x2F;en&amp;#x2F;enterprise-cloud@latest&amp;#x2F;code-secu...&lt;/a&gt;</text></comment>
<story><title>Toyota suffered a data breach by accidentally exposing a secret key on GitHub</title><url>https://blog.gitguardian.com/toyota-accidently-exposed-a-secret-key-publicly-on-github-for-five-years/</url></story><parent_chain><item><author>fiddlerwoaroof</author><text>I wish I could set this up to block pushes proactively instead of reacting to pushed secrets.</text></item><item><author>greysteil</author><text>GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;docs.github.com&amp;#x2F;en&amp;#x2F;code-security&amp;#x2F;secret-scanning&amp;#x2F;secret-scanning-patterns#supported-secrets-for-partner-patterns&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;docs.github.com&amp;#x2F;en&amp;#x2F;code-security&amp;#x2F;secret-scanning&amp;#x2F;sec...&lt;/a&gt;</text></item><item><author>Natsukvshii</author><text>I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it.&lt;p&gt;I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.</text></item><item><author>danielodievich</author><text>Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose&amp;#x27;s support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn&amp;#x27;t have checked it in. I thought that was very proactive and excellent customer service.</text></item></parent_chain><comment><author>neuronexmachina</author><text>Yelp has a &amp;quot;detect-secrets&amp;quot; project that can detect potential secrets and can be used as a pre-commit hook: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;Yelp&amp;#x2F;detect-secrets&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;Yelp&amp;#x2F;detect-secrets&lt;/a&gt;</text></comment>