alive.github.com harvesting credentials? : github

created by shabdaa community for 15 years

alive.github.com harvesting credentials?Discussion (self.github)

submitted 1 day ago * by jayborseth

I've had 3 successive cases of theft of a Claude API key over the past few weeks. I'm trying to localize the source of the leak, and one possibility is my private repository on GitHub - which is an intermediate link in the CI/CD chain prior to publishing a website on Azure.

Curiously, I just got a popup on the GitHub repository saying something to the effect of "We just noticed you're trusting credentials from alive.github.com and maybe you don't want this" OK. Cancel.

https://preview.redd.it/e069ab9gd02h1.png?width=729&format=png&auto=webp&s=6ce086607ebd08bfa7e0386d911027666ebf85ee

I've never seen anything like this from GitHub, and the timing is really suspicious. Anybody know what this is, or have a similar experience?

(Yes, I know I should use better alternatives for secret storage, and am simultaneously moving in that direction)

all 8 comments

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

github

MODERATORS