How to find leaked secrets in Git history and rotate them before misuse

·2 views

A leaked API key, cloud credential, package token or private key in a Git commit should be treated as already exposed, since anyone with a clone can read it and deleting it in a later commit does not remove it from history. The recommended response is to locate every copy, rotate the credential, and block future leaks. Guidance cited includes GitHub's secret-scanning documentation, the open-source gitleaks scanner, and CISA's 2025 alert about the tj-actions/changed-files compromise, which urged rotation of exposed values that may have appeared in CI logs. Teams are advised to scope the incident first, including which repositories, CI logs and forks may hold the value and what the credential can access. Scanning both the working tree and the full history with gitleaks, then rotating credentials and confirming the old ones no longer work, is the suggested sequence.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Does a Silent, Face-Down Phone Really Drain Working Memory? Replications Say Not Much

A 2017 study by Adrian Ward and colleagues at the University of Texas at Austin reported that people performed better on working memory tasks when their phones were in another room than when on the desk. Later direct replications, including a 2022 pre-registered study by Ruiz Pardo and Minda at Western University with 383 analysed participants, found no effect of phone location. Meta-analyses by Parry, Hartanto and colleagues, and Böttger and colleagues pooled dozens of studies and found effects that were either very small or near zero. Researchers have pointed to limited statistical power across the field as a factor in the mixed results. The original headline-grabbing claim therefore looks considerably weaker than first reported.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why some SPC control charts get used and others get abandoned

A quality manager contrasted two control chart binders from the same process, one maintained for over a year and one abandoned after three weeks. The difference came down to whether the chart's limits were computed from the correct subgrouping, so alarms reflected real events. The article explains matching chart type to data, such as I-MR for single measurements and Xbar-R for small subgroups, and warns against mixing shifts, cavities, or trays within one subgroup. It recommends at least 25 baseline subgroups and a small default set of Nelson or Western Electric rules, documented for audit. Each chart should also have a named owner and a clear response plan for when it alarms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing Docker invalid reference format errors in GitHub Actions

Docker invalid reference format errors in GitHub Actions occur when the client rejects an image name locally, before any connection to a registry, because it violates the required reference grammar. The cause is usually visible in the printed reference, such as an uppercase letter in the repository name, a variable that expanded to nothing, or a doubled separator in the tag. Because the check happens in the client, these failures appear within a second and do not clear on retry. The article recommends computing a lowercase image name once, publishing it as a step output, and reusing it across jobs, for example with docker/metadata-action.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Guide Shows How to Run Claude Desktop on Free Open-Source API Backends

A DEV Community article describes a method for using the Claude Desktop interface with a local open-source gateway instead of Anthropic's paid servers. The gateway, called Free LLM API, aggregates dozens of free AI providers under one local key and automatically switches to another model when a rate limit is hit. The guide walks readers through downloading the app and generating free keys from providers such as Google AI Studio, NVIDIA NIM, Cloudflare Workers AI, and OpenRouter. It also suggests adding custom endpoints for stronger coding models and claims the combined free capacity exceeds 7.4 billion tokens per month. The article's performance and capacity claims are presented by the author and have not been independently verified.

0 comments Read more at DEV Community