←back to thread

I scanned all of GitHub's "oops commits" for leaked secrets

(trufflesecurity.com)
199 points elza_1111 | 3 comments | 03 Jul 25 06:44 UTC | HN request time: 0.436s | source
1. john2go3 ◴[03 Jul 25 08:38 UTC] No.44452922[source]▶
Unfortunately for those of us without a Google account, it seems one is required to download the mentioned SQLite database (force_push_commits.sqlite3.)
replies(2): >>44453094 #>>44460609 #
2. gen6acd60af ◴[03 Jul 25 09:08 UTC] No.44453094[source]▶
Concerning.

It's interesting research, but will Truffle Security use the email addresses for lead gen or marketing purposes, like how they mined users' pingbacks from their XSS Hunter fork for stats?

https://portswigger.net/daily-swig/new-xss-hunter-host-truff...

3. CHUCKEESH ◴[04 Jul 25 02:18 UTC] No.44460609[source]▶
That’s a common hurdle when trying to access files like this. You might want to check out LeadsApp—they can help organize data without needing a Google login. It made sorting through similar issues easier for me.