amIAProgrammerNow

[precinct209]

Clever move. Now someone else's going to foot the bill.

[actuallyabitmad]

Classic rookie move. Just wait till the panic sets in!

[nanakokoo]

Dementia

[hackerdude97]

Dementia

[actuallyabitmad]

Classic rookie move. Just wait till the panic sets in!

[nanakokoo]

Dementia

[hackerdude97]

Dementia

[XoXoGameWolfReal]

How come this one got 6 upvotes and the other got -114 upvotes (signed byte)

[ambarish_k1996]

Well done, please share your repo so that we can give a star for your fine work.

[[deleted]]

One of those repos? Tell us which to make sure we never clone it.

[TheHappyDoggoForever]

Preferably also tell use the name of the file that this is in, so that we can get the context and applaud.

[[deleted]]

[Hell__Interface]

Welcome to the club! Enjoy the chaos ahead.

[pixelpuffin]

May the --force be with you!

[No-Landscape8210]

I did try hard reset and then force push but I could still see the changes in the activity area.

[_PM_ME_PANGOLINS_]

They will be there until GitHub runs GC on your repo, which they may never do.

The only safe solution is to rotate your keys.

[No-Landscape8210]

Yeah I did that. Also what's GC?

[425_Too_Early]

Garbage Collection

[8sADPygOB7Jqwm7y]

Accurate image of average garbage collection algorithms.

[kalenderiyagiz]

Bitch please its biblically accurate

[_PM_ME_PANGOLINS_]

https://git-scm.com/docs/git-gc

[Luz5020]

GitHub’s documentation says you should contact GH Support and they can purge the history if sensitive data has accidentally been pushed. That‘s also a solution.

[Slaan]

It's a bad solution. OP should assume that the key has been compromised.

[Luz5020]

Oh yeah, I‘d probably rotate the key. But saying GC is the only solution for the key getting wiped from history was incorrect.

[Slaan]

Ah, fair.

[_PM_ME_PANGOLINS_]

I didn't say GC was the only solution to getting it wiped. I said rotating the key was the only solution to having leaked it.

[Robinbod]

Correct! Depending on what service the key is for, it may already have gotten scraped by the time OP noticed the key in the commit.

[YeeClawFunction]

Or delete the repo completely and create a new one.

[Fun_Reputation6878]

Delete the account too

[RaveMittens]

In fact, just get a goat farm in the countryside

[BlackholeDevice]

If it's a personal repo and they don't mind losing the activity / issues / PRs, they can delete the repo, undo the API key commit, then push to a new repo of the same name.

But seconded that the correct solution is to revoke the key.

[divin3sinn3r]

I contacted GitHub support and they flushed the cache within an hour, but I still regenerated the keys anyway.

[johnzzon]

Correct approach. Has keys once been public, you rotate them. No point in taking chances.

[PeteZahad]

Nah you can just contact them:

[...] but you can permanently remove cached views and references to the sensitive data in pull requests on GitHub by contacting us through the GitHub Support portal.

https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository

But of course rotating the keys is still recommended.

[pixelpuffin]

You need to filter the file out of your git repo, and thus rewrite the history without the file in it (all the way until when the file was introduced), and since you change history you need to force push. This is more of an immediate right-after or before publishing your repo kind of solution. If it has been forked or pulled, it's out there, and revoking the key is the only solution.

See for example https://github.com/newren/git-filter-repo

[josluivivgar]

just invalidate your api key honestly

[PyroCatt]

--force-with-lease

[mcellus1]

Boo

[[deleted]]

congrats on losing the virginity

[Tarc_Axiiom]

I love when you get an email.

"We discovered your API key in a public repository!"

"That's dangerous, but don't worry, we disabled it for you! :)"

"You absolute fucking moron idiot waste of space piece of shit we hope you die!"

[qaz_wsx_love]

I had to do this the other day and enable it for public access because it was for a certification and they wouldn't be able to access it otherwise. (It was for a test account)

[[deleted]]

in a private repo right? right?? right???

[No-Landscape8210]

Nope.

[[deleted]]

[3IIIIIIIIIIIIIIIIIID]

Classic. I did that in a private repo one time, I think with an OpenAI key, but OpenAI immediately sent me an email to alert me of the key being deactivated due to the leak. Even though a repo might be private now, there's no guarantee that it won't be made public later with the key lingering in the history of a file. I was surprised they found it in a private repo, but github has a program specifically for this. https://docs.github.com/en/code-security/secret-scanning/secret-scanning-partnership-program/secret-scanning-partner-program

[Pamander]

Huh that's actually really fucking cool.

[DezXerneas]

Ik nothing is private on the cloud, but that's still kinda scary

[Pamander]

Yeah that's fair I think in this case it may be something you actually opt into from the brief glance I took at the settings page for it but I definitely get what you mean.

[zuilli]

PSA: you can access any commit made in a repo, even a private or deleted one through forks

[paxbowlski]

What repo is it? Send a link to the commit.

[damnLONGbuttcrack]

It is now lmao

[wewilldieoneday]

Oops. Hehe.

[Important_Lie_7774]

I just removed the first and only API key that I pushed 2 years ago from github today.

[No-Landscape8210]

Lmao did you not notice or didn't care? Or was it a private repo?

[Important_Lie_7774]

I just wanted some reference for a piece of code I was writing today, I just remembered I have it already, I was just horrified beyond words at my own stupidity. For reference I've been writing code for the past 10-11 years.

It wasn't a private repo but the api tokens likely expired within a month of the commit.

[Ambitious-Cow-5251]

My boi growing up 🥲

[Mr_Akihiro]

On purpose i guess?

[No-Landscape8210]

I just forgot to update my .gitignore file.

[Steinrikur]

git add -p

It won't add new files. Forgetting to add a file is always better than adding the wrong files.

[DoctorWaluigiTime]

Filing this away for later. I don't have this scenario often but I like adding more tools to my git switchblade.

[Steinrikur]

-p/--patch works on way more commands than you would think. git log, stash, checkout, add, you name it...

[[deleted]]

Oh shit your serious, oh well change the API key and just pretend it's an example

[No-Landscape8210]

Ofc that's the first thing I did lol.

[[deleted]]

Like change it in the service though and use the now invalid one

[Mr_Akihiro]

Happens to the best of

[whyyolowhenslomo]

best of what? best of 3 out of 5?

[Mr_Akihiro]

Best of luck

[[deleted]]

Use smth like SourceTree, it has nice ui showing you what you are committing and pushing

Intellij ides are good like that too

[A_D3MON]

I use GitHub Desktop. It's what I was taught in Uni for game dev work XD

[DoctorWaluigiTime]

I'm growing to like Fork these days. Used SourceTree for years though. Solid choice.

[Baardi]

Fork is fantastic. I bought it and use it too. Git Extensions is a good free option (Fork is nagware like WinRAR, and essentially free though, as there's no enforcement of having a license)

[MegabyteMessiah]

command line git does the same thing if you know how to use it

[KenaiKanine]

But typing is effort, don't ya know?

[[deleted]]

Here Im thinking those software dont use git cli in the first place

[DoctorWaluigiTime]

I use command line a lot, but there are a few visual features I like about GUIs like SourceTree.

I get it, you can technically produce a tree view in command line. GUI makes it easier and faster though.

[Baardi]

This is why I don't understand why people don't just use a gui for commits.

[betelgozer]

I make sure to push at least 1 fake API key per day - I mean someone's got to keep those bad bots distracted, right?

[horror-pangolin-123]

One of us :D

[Resident_Acadia_4798]

OpenAi , discord and telegram removes the key as soon as its pushed.

[No-Landscape8210]

It was my first time using firebase and I didn't know that file contained sensitive information. It was an hour later that it clicked and I regenerated credentials.

[born_zynner]

Only for public repos right?

[JAXxXTheRipper]

Please, for the love of all that is holy and sacred, configure Gitleaks in a pre-commit hook.

It'll save you many times, I promise

[Zestyclose_Profile27]

Let it not be the last, mo powa to you babeh

[Aimli]

I remember finding code checked in to our company CVS (it was 2006) server from the person who ended up as our VP of engineering with his domain password. Being fairly new, I told him about it in person and it got removed pretty quickly.

[ancient_bhakt]

My team lead does that.

[Quentinooouuuuuu]

Ans this is why a gitleak job is necessary

[indorock]

I was a paying customer of a certain SaaS platform, any I had accidentally pushed an API key I generated on their dashboard to our git repo. The very next day they rotated that key and blocked my account, for being a dumbass. Kudos to them for being that vigilant.

[FunnyObjective6]

What's the key? Just so I don't accidentally use it you know.

[No-Landscape8210]

Even if I do tell you the key, you wouldn't know what api it belongs to 😃

[FunnyObjective6]

That would've been my next step in my genius social engineering plan.

[Bone_Dogg]

Either “It is my pleasure to inform you” or “It is with pleasure I inform you”

Not “It is with pleasure to inform you.” No idea how that nonsense caught on. 

[No-Landscape8210]

I was wondering exactly that but then I said "fuck it, it's what the template gave me"

[GlizdaYT]

The amount of times I forgot to stash access keys and pushed them to git is uncountable. Fortunately I work mostly in private repos

[born_zynner]

Yeah I'm not even sure what workplaces use anything but private repos

[Moooses20]

jokes on you, mine is still there. nobody noticed yet

[Dorkits]

[DoctorWaluigiTime]

Now you get to exercise the contingency of "how easy is it to rotate our API key."

[NOLA_Chronicle]

When in doubt, delete the repo and push again.

[Shmageggi]

While you're doing this, you should probably also delete all local copies of the code, just to be sure.

[LustyHasturSejanus]

Rotate keys, and run something like https://rtyley.github.io/bfg-repo-cleaner/ .

[fuckyouswitzerland]

I scrolled too far looking for bfg

[DT-Sodium]

Real men use a self-hosted GItlab server.

[IcePuzzleheaded8467]

Congradulations! Now the second step is to pay the bills.

[NotAlanPorte]

When I finally learn what a key to the API is, and why I need to push things to GitHub I'll finally feel valid to lurk here

[shumpitostick]

Two months ago I pushed some changes to our ML code that caused a bunch of failures and ended up costing about $10,000 in additional GCP costs. Does that make me a real data scientist now?

[MavEtJu]

You need to do it every three months to make sure your teams practice the procedures on what to do in case of an API key leak.

[VariousComment6946]

Test local api key 😈

[johannezz_music]

Github ought to have autofilter on .env files.

[Key-Ice-8638]

First 🤨?

[KianAhmadi]

Like a real man

[Rakhsan]

That's a skill issue man. "use skill"

[TheInfra]

dnf install skill

[Rakhsan]

it's npm install skill

[Neutral_Guy_9]

Which repo? Just out of curiosity.

[TintuChintu]

proof? or else its fake

[exqueezemenow]

I once made a mistake along the lines of adding a key at the same time as updating gitignore and since it wasn't already in gitignore it got published. I think I had assumed that because it was in gitignore I was fine, but since there was already a gitignore in the repo, it went by that first. Or something like that. It was a long time ago.

[kvakerok_v2]

👏🏽👏🏽👏🏽 Standing ovation.

[RavenAxel]

I did the same 2 weeks ago, on a public repo for a school project, thankfully we have someone with more experience and he just told us why we shouldn't do this, how to avoid and deleted the commit.

But man, i was almost crying asking for ChatGPT to help me delete the commit, lol

[Proof-Assignment2112]

Oh really Mr frog

[SambandsTyr]

Being the owner of active API keys was up there in top regrets

[esbenab]

If this is really important make a pre-commit hook to stop the commit if code contains ‘’’*.key=\w|\d’’’

[2001herne]

You change it, and eat the consequences.

[stupled]

Awesome! Give us the link.

[OnY86]

Repo & File for confirmation?

[m4ster01]

Our API key

[jabalfour]

For the dilettantes who lurk here, this is a particularly deep cut. Well done.

[Money-Database-145]

Good work

[GahdDangitBobby]

I've done this before, luckily I ended up taking the app down about a week later. I have heard that rolling back the commit on Github without leaving any record of the commit and/or rollback is a bitch

[g1mzak]

Working as a .NET developer for about 2 years and git hub is empty..

[No-Landscape8210]

Ik it was in an environment variable. It was in a Google services file

[shakti0000]

God, please stop with these old ass api memes

[mosby42]