Everyone has a story about an API key that landed in a public repo. Usually it is not carelessness: a.env file was not in.gitignore yet, or a quick test left a password in a config file, and git add…
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories. An ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer repositories, bringing into focus how compromised…
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise…
GitHub says a ModernBERT-based secret classifier improved weighted acceptance 11.5% and cut median post-push scan time 86%. GitHub said its new context-aware secret classifier is improving secret scanning quality while lowering execution costs, with a two-stage pipeline that combines deterministic regex candidate…
Tool: GitHub secret scanning (a feature for detecting secret information leaked in code) What changed: Reduced false positives and increased speed using a small, context-aware classification model Target audience: Creators and developers who manage code on GitHub On October 13, 2026 (according…
So I built comment and bot protection into the plugin. Here's what one day looks like now, from the plugin's own daily summary email: 5,385 spam comments refused 29 hits on the old login address turned away (the login page was moved,…
Secrets leaking into git repositories cause a disproportionate share of real-world breaches. AWS keys committed to a public GitHub repo get scraped by bots within minutes — sometimes seconds. The fix is to catch them before they ever reach the commit,…
Existing AI-detected password alerts will automatically migrate to the new model at no additional cost AI secret detection in push protection is currently in private preview Adding secret checks to Copilot's /security-review is also planned for private preview New optional…
Result first: I committed a fake API key in a.env file, then "fixed" it the way most people do: add.env to.gitignore and run git rm --cached.env. The file stopped being tracked, but the key was still in…
It keeps three things apart: what AWS states, what I found reading the code, and what is my own method. I compared the PyPI releases 2.257.2 (the last affected V2) and 2.257.3 (the fixed one), reading the source without running it. This is…
Infostealers and combo lists.
An article joins this feed when it matches these terms. Each one is also a search of its own.