Caught a hardcoded AWS key in a client repo 20 minutes before their demo

I was doing a last minute scan of a client's Github repo on Thursday night when Snyk flagged an AWS secret key sitting right in a config file, and their investor demo was the next morning. I called the lead dev at 9pm, we rotated the key in about 15 minutes, and moved it to an env var before anyone outside the team saw it. Scary part is their old scanner never caught it because the file was gitignored but still tracked from an early commit. What tools do you all run for secret scanning, and do you trust them on your whole git history?

0 comments

Log in to join the discussion

Log In

0 Comments

No comments yet

Be the first to share your thoughts on this discussion.