Hacker News Reader

I'm not following this at all. It seems like OP is saying if you share a secret in your (private?) gist and give Algolia permission to read the gist, they will invalidate it. But why would the secret be in a gist and not a repo? Also if you're aware enough to add that partner it seems you're aware to not do dumb things like that in the first place.

View on HN

If you find an exposed token in the wild, for a service supported by GitHub Secret Scanning, uploading it to a Gist will either immediately revoke it or notify the owner.

Ok I see, so any public gist with an algolia key in it will get invalidated? And it would have to follow some pattern like ALGOLIA_KEY=xxx ?

it works for any gist, public or private. it doesn't need to follow a certain format. it's just based on how the secret itself is formatted—it works for secrets that have a predictable pattern, like the AWSK prefix for Amazon keys.

if algolia keys have this predictable pattern, then they can enroll in secret scanning. If they don't then they probably can't

Reply on news.ycombinator.com