<story><title>Incident Report: Inadvertent Private Repository Disclosure</title><url>https://github.com/blog/2273-incident-report-inadvertent-private-repository-disclosure</url></story><parent_chain></parent_chain><comment><author>Hovertruck</author><text>We received an email from Github yesterday informing us that one of our repositories had been accessed by a third party due to this issue. While it&amp;#x27;s not a fun notification to receive, it definitely made our general security paranoia feel justified – we&amp;#x27;re lucky that from the get-go we&amp;#x27;ve held best practices around keeping secrets out of the codebase. Obviously we still dedicated time as a team to prune through our repository history with a fine-toothed comb for anything that could potentially be a vulnerability, as we take this very seriously.&lt;p&gt;One of our engineers came up with a useful script to grab all unique lines from the history of the repository and sort them according to entropy. This helps to lift any access keys or passwords which may have been committed at any point to the top.&lt;p&gt;I think this is a great example to illustrate the tough edges of security to less experienced engineers. Github will most likely never let something like this happen to you, but on the off-chance that they do it&amp;#x27;s great to be prepared. Additionally, the response from Github was very well received. No excuses, just a thorough explanation of what happened.&lt;p&gt;I also can&amp;#x27;t help but mention that we&amp;#x27;re hiring, if you&amp;#x27;d like to work at an organization that values security and data privacy  very highly. :) usebutton.com&amp;#x2F;join-us</text></comment>
<story><title>Incident Report: Inadvertent Private Repository Disclosure</title><url>https://github.com/blog/2273-incident-report-inadvertent-private-repository-disclosure</url></story><parent_chain></parent_chain><comment><author>jorge_leria</author><text>Github takes security seriously, this disclosure post is a proof of that.</text></comment>