Top Tweets for #leakykeys

over 2 years ago

Why don't @Google / @MsftSecIntel / @awscloud have public programmatic ways of reporting lost keys? #LeakyKeys have been a problem we have scaled the ability to identify faster than we have the reporting. Last scan brought in over 3000 parsed keys for Google, @amazon , @stripe , @OpenAI. (These are also providers that have easy ways to identify their keys).

silascutler's tweet photo. Why don't @Google / @MsftSecIntel / @awscloud have public programmatic ways of reporting lost keys? #LeakyKeys have been a problem we have scaled the ability to identify faster than we have the reporting.

Last scan brought in over 3000 parsed keys for Google, @amazon , @stripe , @OpenAI. (These are also providers that have easy ways to identify their keys).

LaurieWired

@lauriewired

over 2 years ago

Google Dorks are still very effective at leaking sensitive information. No, not that kind of dork. It's a way to hunt for data in normally hidden, but otherwise still publicly indexed information. Sites like PublicWWW can search for client-side JS snippets, including API keys with queries like: "api_key" depth:all "apiKey" depth:all Github by default attempts to prevent the leakage of API secrets and such, but that doesn't fix client-side JS!

lauriewired's tweet photo. Google Dorks are still very effective at leaking sensitive information.

No, not that kind of dork.

It's a way to hunt for data in normally hidden, but otherwise still publicly indexed information.

Sites like PublicWWW can search for client-side JS snippets, including API keys with queries like:
"api_key" depth:all
"apiKey" depth:all

Github by default attempts to prevent the leakage of API secrets and such, but that doesn't fix client-side JS!

237

204

38K

Top Tweets for #leakykeys

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users