Massimiliano P.’s Post

Ever wondered how a simple mistake could lead to a major security breach? Well, it turns out that accidentally leaking API keys, tokens, and other secrets in public repositories is a more common issue than you might think. In just the first eight weeks of 2024, GitHub detected over 1 million leaked secrets. That's a staggering number, but there's good news on the horizon. GitHub has taken a significant step forward by making secret scanning push protection a default feature for all pushes to public repositories. This move is designed to catch these secrets before they go public, offering an option to remove them or bypass the block if deemed safe. It's a game-changer for developers and organizations alike, aiming to protect reputations, revenues, and legal standings. The rollout of this feature has begun and will be fully implemented in the coming weeks, providing a much-needed layer of security in the open-source community. Moreover, GitHub's secret scanning capabilities are top-notch, guarding against over 200 token types from more than 180 service providers with the industry's highest precision. For those interested in bolstering their code's security and learning more about these features, GitHub encourages engagement within their community forums. It's a fantastic opportunity to share insights and experiences, further strengthening our collective defense against potential leaks. Remember, in the digital age, our vigilance in protecting our secrets is paramount. Let's embrace these tools and practices to safeguard our work and reputation. Happy Friday! #CyberSecurity #GitHub #DevSecOps #OpenSource Casey Jones

🔒 GitHub has announced it is enabling push protection for all users by default for all public repositories to help reduce accidental information leaks. 🔎 With push protections in place, GitHub will scan each ‘git push’ to a public repository to confirm there are no API keys, tokens, and other secrets that could be exposed as a result. 📅 GitHub trialed push protection in April 2022 and the system has been in public beta since, with the firm making the secret scanning feature generally available in May 2023. 📝 ITPro's Solomon Klappholz outlines everything you need to know about the new changes. #GitHub | #Security | #InfoSec

I found a great explanation of unsafe reflection at https://lnkd.in/gMxWUW7n

GitHub Rotates Keys After High-Severity Vulnerability Exposes Credentials https://lnkd.in/dmtEatqq #Infosec #Security #Cybersecurity #CeptBiro #GitHub #Vulnerability #Credentials

So, for anyone out of the loop – GitHub has now implemented push protection as a default feature, which scans code commits for secrets before accepting them. This helps to safeguard against unintentional exposure of private data, such as access tokens and passwords, within public repositories. GitHub boasts its ability to identify over 200 distinct secret patterns and token types. Even after the couple of high-impact breaches due to exposed credentials and secrets that have happened the last few years, GitHub reported that they detected a staggering amount of over 1 million leaked secrets in public repositories in the first 8 weeks of 2024 alone! What additional proactive measures do you think developers and organizations should adopt to prevent secrets from ever being exposed in the first place? Full article: https://lnkd.in/egczUYFX #github #security #devops #cybersecurity

Since August last year, GitHub has offered users the option to opt-in to secret scanning push protection—a feature designed to automatically intercept and block commits upon the detection of sensitive information. Building on this initiative, GitHub has now made secret scanning push protection mandatory for all pushes to public repositories. With over 95 percent of pushes to private repositories already being scanned by GitHub Advanced Security customers, extending push protection to public repositories reflects a commitment to upholding the integrity and security of the entire GitHub ecosystem. #github #privacy #security #updates #dataprotection #codesecurity #softwaredevelopment

🔐 Mercedes-Benz Source Code Breach: GitHub Leak Exposes Critical Data A leaked GitHub token from a Mercedes-Benz employee led to a significant breach, granting unrestricted access to the carmaker's entire source code stored on GitHub Enterprise. Discovered on January 11, 2024, the breach occurred on September 29, 2023, and was only addressed after Mercedes was alerted on January 22, with the token revoked on January 24. During the exposure period, potential attackers had unmonitored access to API keys, blueprints, cloud access keys, database connection strings, design documents, files, reports, source code, and more. The implications extend beyond intellectual property exposure, posing financial, legal, and reputational risks. This incident highlights the critical need for robust cybersecurity measures, especially in securing access tokens, to prevent extensive data breaches with far-reaching consequences. 🚗💻 #CyberSecurity #GitHubBreach #MercedezBenz

You'd be surprised at the number of public repos on GitHub that contain critical information like login credentials and secret keys. To help prevent that from happening GitHub has made "push protection" the default for all public repositories. Push protection proactively prevents leaks by scanning for secrets before 'git push' operations are accepted and blocking the commits when a secret is detected. The rollout is happening now but it might take a while before you see it on your repos. #cybsecurity #repositories #github #software #supplychainrisk https://lnkd.in/exG2exDQ

Attention GitHub Enterprise Server users! A security vulnerability has been discovered that could allow attackers to bypass SAML single sign-on and gain unauthorized access to your servers. This flaw impacts instances using SAML single sign-on with encrypted assertions. While GitHub has released patches to address this issue, the update introduces other problems. Therefore, those using the vulnerable configuration should update immediately and weigh the risks of the new issues. #github #security #vulnerability #SAML https://lnkd.in/d8-QHhbp

📣 GitHub enables the protection of secret leaks by default 📣 GitHub has enabled push protection by default. This feature prevents secrets from leaking when pushing code to public repositories on GitHub.Push protection proactively prevents leaks by scanning for secrets before 'git push' operations are accepted and blocking the commits when a secret is detected. 👉 Making this feature the default will help prevent security breaches, reputation damage, and legal liability caused by accidental leaks of secrets. However, it also requires users to be careful and vigilant when pushing code. #github #secrets #developers #code #cybersecurity