The .env file I left in a public repo back in March taught me more than any scanner did

Robin Allen · 2026-09-23T23:00:02.842326+00:00

I pushed a test AWS key to a public GitHub repo on a Friday afternoon and a bot found it in under 4 minutes, ran up $2,100 in crypto mining charges by Sunday. I killed the key, set up a pre-commit hook that blocks secrets, and now I wonder why I ever trusted myself to remember. Has anyone found a secret scanning setup that actually catches keys before the commit lands, not after?

Opinions Matter

Loading…

The .env file I left in a public repo back in March taught me more than any scanner did | Devsecops - Opinions Matter