Hacker News Reader

Someone in my company committed an AWS credential to GitHub public repo and AWS actually emailed within few hours saying that the access key has been deactivated or something alike. AWS seem to be scanning the public repos pretty actively for such instances.

View on HN

I've been stupid enough to commit AWS creds to Github twice. (At least twice?) The first time AWS emailed me within an hour. The second time about 20,000 French language spam emails were sent out and I only realized the issue when AWS suspended the credentials because of the bounce rate on the emails. Thankfully only ended up costing me a couple of bucks, but scared the hell out of me.

AWS now sends emails if you commit access keys, even better they are catching loads of other sensitive info having privileged access to the GitHub API. Cool and creepy at the same time, right?

Reply on news.ycombinator.com