<story><title>Billion-record stolen Chinese database for sale on breach forum</title><url>https://www.theregister.com/2022/07/05/shanghai_police_database_for_sell/</url></story><parent_chain><item><author>tpaksoy</author><text>Apparently there was a &amp;quot;blogpost&amp;quot; of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;archive.ph&amp;#x2F;mP3bh&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;archive.ph&amp;#x2F;mP3bh&lt;/a&gt;&lt;p&gt;This is completely unverified though, so take it with a grain of salt.</text></item></parent_chain><comment><author>zricethezav</author><text>Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the gitleaks&amp;#x27; generic rule [2]&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;regex101.com&amp;#x2F;r&amp;#x2F;CLg9TK&amp;#x2F;1&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;regex101.com&amp;#x2F;r&amp;#x2F;CLg9TK&amp;#x2F;1&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;zricethezav&amp;#x2F;gitleaks&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;config&amp;#x2F;gitleaks.toml#L1139-L1147&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;zricethezav&amp;#x2F;gitleaks&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;config&amp;#x2F;g...&lt;/a&gt;</text></comment>
<story><title>Billion-record stolen Chinese database for sale on breach forum</title><url>https://www.theregister.com/2022/07/05/shanghai_police_database_for_sell/</url></story><parent_chain><item><author>tpaksoy</author><text>Apparently there was a &amp;quot;blogpost&amp;quot; of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;archive.ph&amp;#x2F;mP3bh&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;archive.ph&amp;#x2F;mP3bh&lt;/a&gt;&lt;p&gt;This is completely unverified though, so take it with a grain of salt.</text></item></parent_chain><comment><author>bilekas</author><text>It&amp;#x27;s incredibly disappointing actually how often this happens.&lt;p&gt;I can&amp;#x27;t count the amount of SO questions I&amp;#x27;ve had to edit from others posting live API Keys for everything from custom services to AWS.</text></comment>