Hacker News Reader

I think secret detection is great overall, but the only times I've run into it are false positives with client side API keys that are by their nature public.

For example, I recently configured something to use the Google calendar API from JavaScript on the client. It's fully safe to check in this key, since it is intended to be run in client-side JavaScript anyway, but I was still nagged about it.

View on HN

It's a difficult challenge. Secrets detection is probabilistic, without checking the credentials it's nearly impossible to determine, with 100% accuracy, a true vs a false positive. But it has made big improvements. What detection solutions have you been using?

I get automated emails that I didn't sign up for from GitGuardian:

"GitGuardian has detected the following Google Key exposed within your GitHub account."

My understanding was that they could use an API to check whether it was a real key, but perhaps that doesn't say whether it is a client-side or server-side key?

Reply on news.ycombinator.com