[{"data":1,"prerenderedAt":342},["ShallowReactive",2],{"project-14155891":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":33,"aspects":34,"strip":44,"post_text":45,"what":46,"said":69,"maker_in_thread":193,"shape":202,"grid":206,"attempts":304,"same_week":305,"maker_shows":269,"maker_hidden":334,"reader_version":335,"card":336},"14155891","GitMonKey","monitor your repos and commits for exposed private keys","title","Show HN: GitMonKey – monitor your repos and commits for exposed private keys","https:\u002F\u002Fgitmonkey.io\u002F","gitmonkey.io","shaharsol",1492690021,2017,70,45,633,2242,29,"notable","security_privacy","secret scanning","web_app",[21,24,25,26],"exposed private keys","github security","git commits","roasted",-0.667,{"positive":30,"neutral":31,"mixed":30,"critical":32},0,4,17,21,{"privacy":35,"docs":37,"performance":39,"idea":40,"execution":41,"design":43},{"positive":30,"critical":36},8,{"positive":30,"critical":38},1,{"positive":30,"critical":38},{"positive":30,"critical":31},{"positive":30,"critical":42},3,{"positive":30,"critical":30},[38,30,42,38,30,30,30,30,30,38,42,38,30,38,38,30,30,38,42,30,38,30,38,30,38,30,38,30,30,30,30,30,30,38,38,38,38,42,38,38],null,{"problem":47,"audience":53,"pricing":45,"motivation":59,"time_to_build":45,"stack":65,"openness":66,"stage":67,"team_size":68},{"value":48,"source":49,"evidence":50},"Private keys and credentials committed to git repositories get exposed.","maker",[51],{"id":52},"post",{"value":54,"source":49,"evidence":55},"Development teams and R&D managers using GitHub.",[56],{"id":57,"by":11,"text":58},"14156074","There are git hooks that u can run locally, but think as a manager of an R&D team of 10-20 developers. You need to make it centralised.",{"value":60,"source":49,"evidence":61},"Centralised protection for teams, as a second security layer beyond per-developer git hooks.",[62],{"id":63,"by":11,"text":64},"14158800","Because it's harder to enforce on a team whereas a central service (also as a 2nd security layer) deals with it on behalf of the team\u002Forg",[],"unknown","beta","company",{"praise":70,"objections":79,"requests":125,"questions":151,"alternatives":165},[71],{"value":72,"source":73,"evidence":74},"Clever name.","commenter",[75],{"id":76,"by":77,"text":78},"14157824","irfanka","clever name",[80,95,109,116],{"value":81,"source":73,"evidence":82},"Requesting read access to all code from an unknown, unverified company is a privacy risk.",[83,87,91],{"id":84,"by":85,"text":86},"14156143","kierenj","Before I allow this read access to all of my code, what kind of checks should I run through on GitMonKey as an organisation\u002Fproduct? Edit: when I try to go back to the homepage…",{"id":88,"by":89,"text":90},"14156058","dberg","Agreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.",{"id":92,"by":93,"text":94},"14156165","Dunedan","Sounds like a scam to me: - No imprint or any other kind of information who is behind this service on their website - Testimonials which talk about leaked credentials and not…",{"value":96,"source":73,"evidence":97},"Treats symptoms; pre-commit hooks and better practices are preferable.",[98,102,105],{"id":99,"by":100,"text":101},"14159617","ohyeshedid","No, if I want to do my job correctly I'll encourage best practices and address careless deviations. I won't encourage bad behaviour by outsourcing simple workflow tooling to a…",{"id":103,"by":100,"text":104},"14159155","It often takes more thought and effort to do things properly. This seems like another service that treats the symptoms of a problem rather than the problem itself. That kind of…",{"id":106,"by":107,"text":108},"14162962","iNeal","Easier solution: don't commit private keys. Pro-tip: use `git add -p`",{"value":110,"source":73,"evidence":111},"Scanner missed keys in earlier commit history.",[112],{"id":113,"by":114,"text":115},"14157870","SmellTheGlove","One more: I added a repo that I know had some keys in it, and GitMonkey didn't find them. Here's the specifics: I originally made a bunch of commits that included my config.py…",{"value":117,"source":73,"evidence":118},"Company identity, privacy policy and testimonials are missing or unclear.",[119,120,124],{"id":92,"by":93,"text":94},{"id":121,"by":122,"text":123},"14156640","adtac","A little nit-picky, but your \"What Our Users Say about Us\" section is just people describing their mistakes. It says literally nothing about your platform itself.",{"id":84,"by":85,"text":86},[126,133,137,144],{"value":127,"source":73,"evidence":128},"Publish a privacy policy and say what happens to source code.",[129,130],{"id":92,"by":93,"text":94},{"id":131,"by":85,"text":132},"14156194","I would say that if you've forgotten to consider this side of things, it's a big stretch to ask people to trust your app to read all of their source code, which even has the…",{"value":134,"source":73,"evidence":135},"Scan full commit history, not just branches.",[136],{"id":113,"by":114,"text":115},{"value":138,"source":73,"evidence":139},"Fix broken links and a typo in scan messages.",[140],{"id":141,"by":142,"text":143},"14159533","rorosaurus","Hey shaharsol, this looks great. Double check your strings though :) \"Scan 58f90084fa38b600114b33ea succerssfully started.\" Also the \"Profile\" and \"settings\" links don't go…",{"value":145,"source":73,"evidence":146},"Allow login without Google, using GitHub.",[147],{"id":148,"by":149,"text":150},"14156306","MightySCollins","Why does it need to auth using Google? Can it not just use GitHub like the second getting started button suggests?",[152,157],{"value":153,"source":73,"evidence":154},"Who is behind the product?",[155,156],{"id":84,"by":85,"text":86},{"id":92,"by":93,"text":94},{"value":158,"source":73,"evidence":159},"How can access be revoked?",[160,161],{"id":84,"by":85,"text":86},{"id":162,"by":163,"text":164},"14157419","mynameisvlad","You wouldn't revoke its access on their end, you'd do it on GitHub's end: https:\u002F\u002Fgithub.com\u002Fsettings\u002Fapplications Otherwise, GH would still have the approval on file (there's no…",[166,173,180,187],{"value":167,"source":73,"evidence":168},"truffleHog",[169],{"id":170,"by":171,"text":172},"14156085","sevagh","How about this one? https:\u002F\u002Fgithub.com\u002Fdxa4481\u002FtruffleHog Posted here a few months ago.",{"value":174,"source":73,"evidence":175},"git-hound",[176],{"id":177,"by":178,"text":179},"14167071","ezekg","Also, if you want to have more control over what gets matched (as opposed to only checking entropy): https:\u002F\u002Fgithub.com\u002Fezekg\u002Fgit-hound (I'm the author of this one.)",{"value":181,"source":73,"evidence":182},"pre-commit hooks (detect-private-key)",[183],{"id":184,"by":185,"text":186},"14158388","avh02","http:\u002F\u002Fpre-commit.com\u002Fhooks.html calling attention to detect-private-key and detect-aws-credentials (disclaimer-ish: was original contributor on the latter hook but been way…",{"value":188,"source":49,"evidence":189},"GitHub's built-in token revocation",[190],{"id":191,"by":11,"text":192},"14156069","Github does this actually but only from github access tokens generated from their API... if you generate an oauth access token and commit it, they will automatically revoke it.",{"comments":36,"answered":31,"key":194},[195,198,199],{"id":196,"text":197},"14156164","It's a product of Tikal Lab, which is a unit in http:\u002F\u002Ftikalk.com",{"id":57,"text":58},{"id":200,"text":201},"14156172","If GitMonkey has your key on record - it means we're not the only ones having it. You should revoke it immediately. So even if our db is breached, it should only contain a list…",{"commenters":203,"max_depth":204,"maker_replies":36,"first_comment_mins":203,"lifespan_hours":205},27,6,28,[207,209,211,213,215,218,219,220,223,225,227,232,233,234,236,239,241,244,246,249,250,253,254,255,258,260,262,264,267,271,275,277,280,282,285,287,292,296,299,301,303],[84,30,38,208,85,30],"project\u002Fcritical\u002Fprivacy",[196,30,30,210,11,38],"maker\u002Fneutral\u002Fnone",[162,30,42,212,163,30],"project\u002Fneutral\u002Fprivacy",[121,38,38,214,122,30],"project\u002Fcritical\u002Fdocs",[170,216,30,217,171,30],2,"other\u002Fneutral\u002Fnone",[177,216,30,217,178,30],[184,42,30,217,185,30],[221,42,30,217,222,30],"14159026","brianjking",[224,42,30,217,185,30],"14159629",[113,31,38,226,114,30],"project\u002Fcritical\u002Fperformance",[228,229,42,230,231,30],"14156050",5,"project\u002Fneutral\u002Fidea","DINKDINK",[88,229,38,208,89,30],[57,229,30,230,11,38],[99,229,38,235,100,30],"project\u002Fcritical\u002Fidea",[237,229,38,208,238,30],"14156077","fredley",[200,229,30,240,11,38],"maker\u002Fneutral\u002Fprivacy",[242,229,30,243,238,30],"14156222","commenter\u002Fcritical\u002Fprivacy",[245,229,38,208,149,30],"14156411",[247,229,42,212,248,30],"14157429","CGamesPlay",[191,229,30,217,11,38],[251,204,38,235,252,30],"14157918","rgun",[63,204,30,230,11,38],[103,204,38,235,100,30],[256,204,30,217,257,30],"14159291","newman314",[148,259,38,208,149,30],7,[261,259,30,212,11,38],"14156400",[263,259,38,208,149,30],"14156505",[265,36,30,217,266,30],"14157314","yeukhon",[268,269,30,217,270,30],"14156875",9,"reddytowns",[272,273,30,217,274,30],"14156130",10,"nailer",[276,273,30,217,11,38],"14156137",[278,273,30,217,279,30],"14156207","antaviana",[281,273,30,217,266,30],"14157266",[141,283,38,284,142,30],11,"maker\u002Fcritical\u002Fexecution",[106,286,38,235,107,30],12,[288,289,38,290,291,30],"14156087",13,"project\u002Fcritical\u002Fexecution","jwilk",[293,294,38,290,295,30],"14156834",14,"sleepychu",[76,297,42,298,77,30],15,"project\u002Fneutral\u002Fdesign",[92,300,38,208,93,30],16,[302,300,30,240,11,38],"14156182",[131,300,38,208,85,30],[],[306,311,316,321,325,330],{"id":307,"name":308,"points":309,"category":310},"14180673","Timestrap",264,"productivity",{"id":312,"name":313,"points":314,"category":315},"14202456","Commento",233,"web_saas",{"id":317,"name":318,"points":319,"category":320},"14183597","nescat.gcubed.co",196,"games",{"id":322,"name":323,"points":324,"category":310},"14204759","Kobble",179,{"id":326,"name":327,"points":328,"category":329},"14167466","WrapAPI v2",166,"dev_tools",{"id":331,"name":332,"points":333,"category":320},"14202124","BreakLock",139,false,"v2",{"id":337,"name":5,"line":6,"ai":334,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":338,"top":18,"kw":339,"maker":11,"domain":10,"tier":19,"attempts":30,"strip":340,"url":9,"mix":341,"praise":72,"objection":81,"sub":21},14155891,-0.67,[21,24,25,26],"1031000001310110013010101010000001111311",[30,31,30,32],1794036554521]