Batuta ku mpukapuka .env Malu masokoka anyi AWS Keys ya GitHub Repo: Bua tshinyi dijimija dia mukanda kadiena disokoka¶

Kujingulula sekonde dikumi kunyima kua dinyema git push origin main (anyi kukudimuna tshilaminu tshia pa nkaya ku Public) ne: dilaya diebe divua ne meyi malelela .env tshikandakanda, AWS AKIA... Access Key ne Secret Key, OpenAI/Anthropic API key, Stripe sk_live_... tshimanyishilu tshia mudimu, tshilaminu tshia PostgreSQL/MongoDB tshidi ne mot de passe, anyi tshidi katshiyi tshisokoka $HOME/.ssh/id_ed25519 tshifungu tshia pa nkaya ntshia njiwu itanu ya malu a bukubi bua ku Enternete. Botnets ya automated credential-harvesting botnets idi itungunuka ne kuela nkonko kudi bantu GitHub Events Firehose (api.github.com/events) ne clone newly pushed commits inside 1.5 to 4 secondes of your git push kujikija. Tshibi menemene, pabuipi ne muenji wa mudimu yonso udi ne buôwa udi wenza tshilema tshinene tshia muomumue: badi bajimija .env tshikandakanda tshia muaba uudi, weja .env ku .gitignore, ne kuela tshipungidi tshibidi tshidi ne tshiena bualu "remove .env" anyi "oops". Kutuma tshipungidi tshibidi tshidi tshijimija .env kena usokoka tshintu nansha tshimue: tshisokomenu tshia mukanda tshidi tshishala tshibala 100 pa lukama kashidi munda mua dishilangana dia tshipungidi tshia kumpala (git log -p), ne nansha wewe muenzeje (git push --force) pa mutu pa tshitupa, tshipungidi tshidi katshiyi tshileja (dangling blob) udi ushala mupeta kudi bantu bonso ku diambuluisha dia URL wende wa GitHub ne bilejilu bia Pull Request too ne padibu bamumbusha patoke. Shi bintu bya bumanyishi bya patupu byadi bya kwingidijibwa kudi baluishi mwanda wa kutuma bintu bya lupeto, kukwata DNS domaine obe, nansha kukwata muntu obe wa mu matutu, tangila balombodi betu pa diandamuna dia ransomware ne malware, dikuata dia dina dia kazubu, DNS mufue, ne dikuata dia site, ne Google Workspace anyi Microsoft 365 custom domain admin lockout. Shi dibutuka dia mukanda wa dianyisha didi mua kunyanga bukubi bua babedi ba mu lupitadi, malu adibu balombola mu midimu ya bianza, anyi mishindu ya kutuma bantu mu tshimpitshimpi, bikila nimero wa tshimpitshimpi wa muaba unudi (911 mu États-Unis ne mu Canada, 112 mu matunga masanga a ku Mputu, 999 mu Royaume-Uni) anyi tangila mukanda wetu wa matunga a bungi wa nomba ya tshimpitshimpi.

Enza nunku mpindieu¶

1. KUJIKIJA, KUJIKIJA, NE KUSHINTULULA tshisokomenu tshionso tshidi tshipatuka ku tshisanji tshia mufidi wa bintu KUMPALA - mu tusunsa 120 tua kumpala - kumpala kua kujimija sekonde umue wa lubilu git mêyi: Padi bualu busokoka bufika ku tshilaminu tshia GitHub, GitLab, anyi tshia Bitbucket nansha mu tusunsa 3, angata tshifungu atshi bu tshiosha kashidi ne tshidi kale mu bianza bia baluishi badi benza malu nkayabu. Kakuena bungi bua git reset --hard, git push --force, anyi kujimija tshilaminu tshia bintu kudi mua kujimija tshifungu tshia mu tshilaminu tshia bintu tshia scraper bot uvua mumane kuangata commit webe ku #2 muibidi. Buela mu AWS IAM, Stripe, OpenAI, database consoles, anyi GitHub SSH settings mpindieu ne Dectivate / Delete / Roll the key immediately.
2. Tangila Cloud Billing ne Audit Logs (AWS CloudTrail, GCP Cloud Audit Logs, Stripe Logs) bua dididishi didi pankatshi pa git push ne diumusha dia tshifungu tshieba: Bots ya cryptomining idi yenza mudimu ne leaked AWS_ACCESS_KEY_ID (AKIA...) mikanda ya bumanyishi mu tusunsa 30 too ne ku 90 bua kuenza mudimu ne GPU ya bungi menemene (p4d.24xlarge / g5.48xlarge) mu bitupa bionso bia AWS bisokoka (ap-east-1, me-south-1, af-south-1) ne enza bena mudimu ba IAM ba kunyima anyi Lambda persistence hooks bua ishale munda mua konte webe wa AWS nansha wewe mumane kujimija tshifungu tshidi tshipatuka.
3. KUENZEKI nansha kakese "Delete .env" kuenza - mu bulelela, kufunda "delete secret" anyi "remove password" mu mukenji wa tshipungidi udi ukoka bots scraper: binunu bia scripts ya threat-actor idi ilomba GitHub Keba meyi a tshipungidi adi ne "remove .env", "delete key", "oops", ne "remove credentials", pashishe tuaku pa tshienzedi tshimue tshia panyima mu malu a kale bua kuiba tshifungu.
4. Funda kabidi malu onso a kale a tshilaminu tshia Git ku diambuluisha dia git filter-repo (anyi BFG Repo-Cleaner) bua kumbusha tshikandakanda anyi kumbusha meyi a tshisokomenu mu tshitupa tshionso tshia kale, mutshi, ne tag: git filter-branch udi mupangile kudi mudimu wa Git; enza mudimu ne git filter-repo --invert-paths --path .env (bua kumbusha mukanda mu bionso) anyi git filter-repo --replace-text expressions.txt (bua kupingaja meyi a tshisokomenu kampanda ne ***REMOVED*** munda mua mikanda ya kode kuyi ujimija mikanda).
5. Force-push matamba onso ne bimanyinu (git push origin --force --all), NE kumbusha bintu bia GitHub bidi mu tshilaminu tshia bintu (dangling commits): Mona bualu busokoka budi bafundi ba bungi kabayi bamanye: nansha wewe mumane kuenza mudimu git filter-repo ne git push --force, Ba-server ba GitHub badi balama SHA wa kale wa commit ne muoyo mu cache wabu wa bintu (git cat-file), mbuena kuamba ne muntu yense uvua mufunda SHA wa maleta 40 mu API wa malu a bantu bonso udi mua kumona github.com/user/repo/commit/<OLD_SHA>. Tudi tumvuija kuinshi eku mushindu wa kujikija diakamue bintu bidi bishala mu tshilaminu tshia bintu ku diambuluisha dia GitHub Support / API anyi pa kumbusha ne kuenza kabidi tshilaminu.
6. Teka tshiamu tshia muaba pre-commit tshikebelu tshia malu masokoka (gitleaks anyi trufflehog) munda .git/hooks/pre-commit Kumpala kua wewe kufunda mulongo mukuabu wa kode: A 10-second gitleaks protect --staged pre-commit hook udi utangila mulongo wonso mulongolola pa portable webe ne ukanga git commit kumpala kua bualu busokoka kupatuka mu tshiamu tshiebe.

Mutshi wa mapangadika: dilama dia lukasa, dishintuluka, ne dijimija dia malu a kale a Git¶

Enza mudimu ewu mu bulongame bua tshikondo (Kumbusha KUMPALA -> Dilama dia tshikebelu BUIBIDI -> Kumbusha malu a kale a Git MUSATU):

flowchart TD
    Start["Tshisokomenu tshifila mu tshilaminu tshia bantu bonso (.env, AWS/GCP Key, DB Password, Stripe/OpenAI Key, anyi Private SSH Key)"] --> Step1["MINUTE 0 TO 2 (PRIORITY #1): Kumbusha / Kuela tshifungu tshionso tshidi tshileja ku tshiibi tshia mufidi diakamue"]

    Step1 --> SecretType{"Mmushindu kayi wa dianyisha uvua munda mua tshipungidi?"}

    SecretType -->|"Tshiamu tshia mudimu tshia mu matutu (AWS AKIA, GCP Service Account JSON, Azure SP)"| CloudAudit["MINUTE 2 TO KU 10: Tangila CloudTrail / Activity Logs -> Terminate Rogue EC2/Compute Instances in All Regions -> Delete Unauthorized IAM Users/Roles/STS Sessions"]

    SecretType -->|"Database URI / Password (Postgres, MySQL, MongoDB, Redis, Supabase)"| DBAudit["MINUTE 2 TO KU 10: Shintulula meyi a tshisokomenu a muena mudimu wa DB + Shipa malanda adi menzeke (pg_terminate_backend) + Kukanga tshisumbu tshia bukubi tshia Firewall anu ku IPs ya pa mutu"]

    SecretType -->|"API Token anyi SSH Key (Stripe, OpenAI, GitHub PAT, Slack, Private SSH Key)"| TokenAudit["MINUTE 2 TO KU 10: Ela tshifungu tshia API mu Dashboard / Umbusha tshifungu tshia SSH tshia bantu bonso mu $HOME/.ssh/authorized_keys & GitHub Settings -> Audit Recent API Usage Logs"]

    CloudAudit --> RepoVisibility{"MINUTE 10 TO 20: Mmunyi muudi musue kujikija tshilaminu tshia GitHub?"}
    DBAudit --> RepoVisibility
    TokenAudit --> RepoVisibility

    RepoVisibility -->|"Lubilu lua 100% lua dijimija dia tshisokomenu (Kakuyi bualu bunene/Muyuki wa mitoto wa kulama)"| NukeRepo["1. Supula tshilaminu tshijima tshia bintu mu malu a GitHub. 2. Enza mudimu ne git filter-repo bua kusukula malu a kale. 3. Enza Repo mupiamupia ne Push Clean History (Udi ubutula diakamue Commit SHAs yonso milama)"]

    RepoVisibility -->|"Udi ne tshia kulama mitoto ya kale, bilumbu, PRs, ne forks"| RewriteRepo["1. Enza git filter-repo (--invert-paths anyi --replace-text). 2. Enza git push --force --all & --tags. 3. Ela GitHub Support / Support Portal bua kumbusha Dangling Commit SHA Cache"]

Tshitupa 1: Minite 0 too ne ku 2 - Dibeji dia dishima dia lukasa dia kudi mufidi wa bintu¶

Kukangula tshitudilu tshia mvita bua kuluangana natshi to git rebase padi tufungu tuebe tua dienza bintu tutshidi tuenza mudimu. Fina buludiludi ku mufidi udi mu lutatu udi kuinshi eku ne kushipa tshijadiki kumpala:

Tshitupa 2: Minite 2 too ne ku 10 - Kutangila ni bena tshinyangu bakadi benze tshiibi tshia panyima (AWS / Cloud Containment)¶

Shi udi mupatuke .env mukanda uvua ne AWS Access Key (AKIA...), Google Cloud Service Account JSON, anyi Azure Service Principal, kumbusha tshifungu tshidi tshipatuke ntshitupa tshia mvita. Udi ne tshia kujadika ne: bot udi wenza mudimu nkayende ki mmuenze mudimu ne sekonde 90 ayi bua kujadika dikalaku munda mua konte webe wa mu matutu to:

Tshikebelu tshia 6-Point AWS Post-Leak Forensic Audit¶

1. Tangila AWS CloudTrail -> Event history bua mabikila onso a API menza kudi tshidi tshipatuka Access Key ID:
2. Kangula AWS CloudTrail Console -> Event history.
3. Shintulula tshikebelu tshia ku Read-only too ne ku Access key ID ne ulamakaja tshidi tshipatuka AKIA... tshingoma.
4. Tangila bualu buonso budibu bafunde katshia ku minite uudi munyeme git push. Keba nangananga: CreateUser, CreateAccessKey, AttachUserPolicy, CreateRole, AssumeRole, GetSessionToken, RunInstances (EC2), RequestSpotInstances, CreateFunction (Lambda), anyi SendEmail (SES spam).
5. Umbusha tshitupa tshionso tshidi tshienza mudimu STS bikondo bifumina kudi muena mudimu au:
6. Nansha wewe mumane kujimija AKIA... tshifungu tshia kubuela, pikala muena tshinyangu mubikile sts:GetSessionToken Kumpala kua wewe kujimija tshifungu, tshiabu tshia tshitupa tshîpi ASIA... tshimanyishilu tshia tshisangilu tshidi tshishala ne mushinga too ne ku meba 36.
7. Bua kushipa bantu bonso badi benza mudimu STS bimanyinu bia muena mudimu wa IAM diakamue, ndaku ku IAM -> Users -> [Leaked User] -> Permissions -> Add inline policy ne fina Revoke sessions (udi ulamakaja bualu budi bumueneka patoke Deny * mikenji ya tshimanyishilu tshionso tshipatula muaba aws:TokenIssueTime udi kumpala kua mpindieu.).
8. Tangila IAM -> Users ne IAM -> Roles bua konte mipiamipia mienza:
9. Teka bantu bonso badi benza mudimu ne IAM bilondeshile tshikondo tshia difuka. Supula muena mudimu yonso udi kuyi mumanye (admin-backup, sys-monitor, support-bot) ne kujadika Trust relationships tab pa midimu yebe ya IAM bua kujadika ne: muntu udi ukubunda ki mmuele ID wende wa AWS Account wa pambelu to ("Principal": {"AWS": "arn:aws:iam::999999999999:root"}) bu mulombodi wa kueyemena.
10. Kwenzela AWS Resource Explorer anyi EC2 Global View bua kutangila bitupa bionso 30+ bia AWS bua cryptominers misokoka:
11. Bantu badi babunda bantu kabatu batamba kuenza malu a cryptomining to us-east-1 muaba uudi mua kubamona pa tshiamu tshieba tshia mashinyi. Kadi, badi batuadija p4d, g5, anyi c6i.32xlarge bilejilu mu ap-southeast-3 (Jakarta), me-central-1 (UAE), il-central-1 (Tel Aviv), anyi sa-east-1 (São Paulo).
12. Kangula EC2 Console -> EC2 Global View (udi utangila tshitupa tshionso tshidibu banyishile mu mesa umue) ne Ujikija diakamue malu onso adi kaayi maanyishibue.
13. Kanzulula AWS Support Billing Case diakamue pikala bilumbu bia tshinyangu bipatule bitadi:
14. Shi bot mupatuke $8,000 wa EC2 GPU instances kumpala kua wewe kuyijikija, kutshinyi: paudi ulama konte, ujimija tshifungu, uteka root/IAM MFA, ne mumbushe tshifungu mu GitHub, ukangula AWS Account and Billing Support Case udi umvuija dikuma dia GitHub dia mpukapuka ne mishindu yebe ya dilongolola. AWS utu ufila difutu dia luse dia musangu umua bua dinyanguka dia GitHub dia mpukapuka padi tshisumbu tshiabu tshia bukubi tshijadika ne: muaba udibu balamina bintu mmukezuke.

Tshitupa 3: Bua tshinyi dijimija dia mukanda mu tshipungidi tshipiatshipia didi dipanga - ne mushindu wa kufunda kabidi malu a kale bimpe ne git filter-repo¶

1. Bua tshinyi git rm .env && git commit -m "delete .env" kena ne mushinga to¶

Git i tshilaminu tshia mikanda tshidi mua kukumbaja anu malu adimu (Directed Acyclic Graph / DAG ya bintu, mitshi, ne bintu bia blob): - Tuangate ne: Kufila A1B2C3 musakidila .env (Blob 998877). - Fuanyikijabi ne minite 2 pashishe udi unyema git rm .env, kukumbaja .env ku .gitignore, ne kuela Commit D4E5F6. - Padi muntu utangila liste wa mikanda ya mpindieu idi pa dibeji dia kumpala dia GitHub kakumona to .env, Kuenza A1B2C3 ne Blob 998877 batshidi anu 100 pa lukama tshitupa tshia tshilaminu. Muntu yense udi wenza mudimu git clone bintu bia kuangata Blob 998877, muntu yense udi utua pa "Commits" pa GitHub udi mua kutua A1B2C3 bua kubala .env tshikandakanda mu mifundu mipepele, ne biamu bia mudimu bidi bienza mudimu nkayabi (trufflehog git https://github.com/user/repo) tangila tshintu tshionso tshia kale mu masekonde 2.

2. Tshitupa ku tshitupa: Kujimija mukanda anyi meyi masokoka mu malu onso a kale ku diambuluisha dia git filter-repo¶

Mudimu wa Git ne GitHub badi balomba git-filter-repo (udi upingana pa muaba wa bitekete bitekete, bidi bitamba kuenza bilema git filter-branch ne udi mene mua kushintuluka kupita BFG Repo-Cleaner).

1. Teka git-filter-repo (Bidi biangata masekonde 5):

   # On macOS (Homebrew):
   brew install git-filter-repo
   
   # On Linux / Windows (via pip / apt):
   pip3 install git-filter-repo
   

2. Wenza tshilaminu tshia bukubi tshia tshilaminu tshiebe tshia bintu kumpala kua kufunda kabidi malu a kale:

   cp -r $HOME/projects/my-repo $HOME/projects/my-repo-backup
   cd $HOME/projects/my-repo
   

   (Dimanya: Shi ukadi mumbushe tshieba tshieba .env tshikandakanda, ikala mushindike ne: udi ne kopi mukezuke wa .env udi mulamibue mu /tmp/.env.safe pambelu pa tshilaminu, bualu git filter-repo ne kukupula .env mu tshilaminu tshieba tshia mudimu kabidi.)
3. Sungula mushindu A (Busha njila wa mukanda mujima bu mudi .env anyi id_rsa) NANSHA Mushindu B (Kumbusha meyi masokoka adi munda mua mikanda ya kode):
4. Mushindu A: Umbusha bionso .env (anyi config/secrets.json) ku tshipungidi tshionso mu miyuki ya kale:

   git filter-repo --invert-paths --path .env --force
   

   (Bua tshinyi --invert-paths? Kakuyi --invert-paths, git filter-repo --path .env udi ulama ANYI .env ne udi ujimija bintu bikuabu bionso. Kusangisha --invert-paths --path .env udi wambila Git bua kulama bintu bionso EXCEPT .env mu bipese bionso, matamba, ne bimanyinu.)
5. Mushindu B: Lama tshikandakanda tshia kode (app.py / config.js), kadi umbusha meyi masokoka a mu tshikoso tshionso tshia kale: Enza mukanda wa mifundu /tmp/secrets-to-scrub.txt udi ne meyi masokoka (anyi regex) ku mulongo:

   AKIAIOSFODNN7EXAMPLE==>REDACTED_AWS_KEY
   sk_live_51NzExampleSecretKey999==>REDACTED_STRIPE_KEY
   regex:postgres:\/\/non_at_chars@==>postgres://REDACTED_DB_CREDENTIALS@
   

   Mpindieu nyema git filter-repo --replace-text:

   git filter-repo --replace-text /tmp/secrets-to-scrub.txt --force
   shred -u /tmp/secrets-to-scrub.txt 2>/dev/null || rm -P /tmp/secrets-to-scrub.txt
   

6. Weja .env ku .gitignore nunku kuena mua kuenza kabidi mu minite 5 kunyima to:

   echo ".env" >> .gitignore
   echo "*.pem" >> .gitignore
   git add .gitignore
   git commit -m "chore: update gitignore rules"
   

7. Weja tshiamu tshieba tshia GitHub (git filter-repo udi umbusha ku budisuile origin bu tshikebelu tshia bukubi) ne kuenzeja matamba onso ne bimanyinu:

   git remote add origin git@github.com:YOUR_USERNAME/YOUR_REPO.git
   git push origin --force --all
   git push origin --force --tags
   

Tshitupa 4: Tshisokomenu tshia GitHub Cache Trap (Dangling Commits) ne mushindu wa kutshisukula¶

Mona bualu bua mushinga mukole budibu bafunde mu GitHub's Official Docs (Kumbusha malu a mushinga mukole mu tshilaminu tshia bintu): - Paudi unyema git filter-repo ne git push origin --force --all, tshintu tshionso tshidi mu tshilaminu tshieba tshidi tshipeta tshitupa tshipiatshipia tshia maleta 40 tshia SHA-1, ne tshiebe main tshimanyinu tshia filiale tshidi tshiya ku histoire mupiamupia mukezuke. - NANKA, tshilaminu tshia Git tshia GitHub katshiena tshisangisha bintu bia bukoya diakamue to (git gc --prune=now) SHA wa kale, udi kayi ne tshimanyishilu. - Bidi biumvuija ne, pikala bot wa muena lukuna mufunde hash wa kale (e.g., a1b2c3d4...) wa ku GitHub Events API wa bantu bonso pauvua muele tshia kumpala, badi anu mua kunzulula https://github.com/YOUR_USERNAME/YOUR_REPO/commit/a1b2c3d4... mu tshikebelu tshionso tshia ku Enternete ne kutangila tshiebe .env tshikandakanda nansha kunyima kua wewe mumane kuenzeja malu a kale. Tshibi menemene, bikala bualu busokoka bumueneka munda mua Dilomba dia kukoka, refs/pull/12/head udi ulama tshipungidi atshi tshikumbane bua kashidi.

Mushindu kayi wa kubutula bintu bidibu balame mu tshilaminu tshia bintu bia GitHub mpindieu:¶

1. Mushindu 1 (Musangu, 100% wa dijimija dijima - Mbimpe pikala tshilaminu katshiyi ne ntatu mikole/PRs/Mitoto):
2. Ndaku mu tshilaminu tshieba tshia bintu pa GitHub -> Settings -> Tangila too ne kuinshi (Danger Zone) -> Fina Delete this repository.
3. Enza tshilaminu tshipiatshipia tshidi ne dina dia muomumue pa GitHub ne wenze tshikebelu tshieba git filter-repo tshilaminu tshia muaba udibu (git push -u origin main).
4. Kujimija tshilaminu tshia bintu pa GitHub kudi kubutula diakamue mishindu yonso ya kumona ya pa buloba bujima ya SHAs ya kale ya tshilaminu (404 Not Found).
5. Mushindu 2 (Kulama mitoto, bilumbu, ne PRs - Kuenza mudimu ne diambuluisha dia GitHub / Dilengeja dia tshisokomenu):
6. Tshia kumpala, wangate tshimanyinu tshia maleta 40 tshia SHA tshia tshipungidi tshia kale tshivua ne bualu busokoka (tangila git reflog mu tshilaminu tshiebe tshia bintu anyi mu mikanda yebe ya dimanyisha ya GitHub).
7. Kangula GitHub Support (support.github.com) ne wenze mudimu ne tshiamu tshia mudimu tshia Kumbusha malu adi ne mushinga / Kumbusha malu adibu balame mu tshibutshilu (kuleja URL wa tshilaminu ne SHA(s) ya tshilaminu tshidi tshitangile). Tshiamu tshia mudimu tshia GitHub tshidi tshienza mudimu diakamue ku luseke lua tshiamu tshia mudimu git gc diumusha dia tshisokomenu didi dinyanga bintu bia ku Enternete bidibu balame ne bintu bidi kabiyi bileja kakuyi dijimija dia tshilaminu tshieba.
8. Umanyishe bena mudimu netu bonso bua git clone bipiabipia (KAMUENA git pull):
9. Ambila muenji wa mudimu yonso wa mu tshisumbu tshieba ne: "KUENJI git pull ne kuela." Shi muena mudimu netu uvua muenze tshilema tshibi kumpala udi unyema git pull (udi usangisha malu a kale a bukoya ne malu mapiamapia adibu bafunde kabidi) ne utuma, nebatume malu adibu bafute .env udi mua kupingana pa GitHub. Muena mudimu yonso udi ne tshia kujimija kazubu kende ka muaba udiye ne kuenza mudimu mupiamupia git clone, anyi kunyema git fetch origin && git reset --hard origin/main.

Tshitupa 5: Kupangisha dinyanguka dia matuku atshilualua bua kashidi (Gitleaks Pre-Commit Hook & GitHub Push Protection)¶

Angata sekonde 60 mpindieu bua kuenza bua se: kabikadi mua kuenzeka mu makumi bua kuenza kabidi bualu busokoka ku mpukapuka to:

1. Kuenza bua GitHub ikale tshianana "Push Protection for Yourself" mu konte webe mujima wa GitHub:
2. Enda ku GitHub Settings (malongolola a profil webe, kuulu ku dia balume) -> Code security and analysis (anyi Code security).
3. Tangila too ne ku Secret scanning -> Enza Push protection for yourself.
4. Ne bualu ebu buenzeja, dîba dionso diudi unyema git push ku ordinatere yonso too ne ku tshilaminu tshionso tshia bantu bonso anyi tshia pa nkayebe, tshiamu tshia mudimu tshia GitHub tshidi tshitangila packfile webe udi ubuela kumpala kua kuitaba dituma: yeye mumone tshifungu tshia AWS, tshifungu tshia OpenAI, tshifungu tshia Stripe, tshifungu tshia SSH tshia pa nkaya, anyi tshimanyinu tshia Slack, GitHub udi ubenga git push mu terminal webe kumpala kwa commit kutuadija.
5. Teka gitleaks bu muena musoko pre-commit ela tshiamu tshieba tshia ku bianza:

   # Install gitleaks:
   brew install gitleaks   # (or download binary on Linux/Windows)
   
   # Add a pre-commit hook inside your repository (.git/hooks/pre-commit):
   cat << 'EOF' > .git/hooks/pre-commit
   # /usr/bin/env bash
   gitleaks protect --verbose --redact --staged
   if test $? -ne 0; then
     echo "COMMIT BLOCKED BY GITLEAKS: High-entropy secret or API key detected in staged changes."
     exit 1
   fi
   EOF
   chmod +x .git/hooks/pre-commit
   

Nomba ya tshimpitshimpi ya mu tshijengu ne mikenji ya bibambalu¶

Shi tshienzedi tshia mpukapuka tshia GitHub tshifikisha ku dibuela dia muntu kayi muanyishibue mu malu a muntu nkayende (PII / PHI), mishindu ya malu a bukola bua mubidi, anyi nzubu ya mbulamatadi, ilonda mikenji ya dimanyisha dia dishipa dia mikenji:

• États-Unis ne Canada:
• Dikuba dia muoyo mu tshimpitshimpi / Dinyanguka dia bintu bia mushinga mukole: Ela 911 pikala dishipa dia mikenji ya nzubu ya mudimu dinyanga midimu ya lupitadi anyi malu a bukubi bua mubidi.
• Tshibambalu tshia bukubi bua malu a ku Enternete ne a nzubu ya mudimu (CISA) & FBI (IC3): Bikala bena tshinyangu benze mudimu ne tufungu tua mu matutu tudi tupatuka bua kupatula malu anyi kutuma programe wa dinyanga dia bintu, manyisha CISA (1-844-Say-CISA / cisa.gov/report) ne FBI Centre Crime Complaint Center (ic3.gov).
• SEC, FTC, & State Attorney General Data Breach Notification: Shi CloudTrail / database access logs ileja ne adrese wa IP udi kayi muanyishibue mmubuele mu malu a muntu nkayende a muena mudimu (PII) anyi mikanda ya malu a bukola bua mubidi (HIPAA ePHI) kumpala kua tshifungu tshidi tshipatuka tshipatuka, yukila ne mufidi wa mibelu diakamue pa bidi bitangila mêba a dimanyisha dia dishipa dia mikenji ya ditunga ne luapolo lua HHS OCR / FTC Safeguards Rule lua mbulamatadi.
• Tshibambalu tshia bukubi bua malu a ordinatere tshia mu Canada: Bikila 1-833-CYBER-88 (1-833-292-3788) anyi luapolo lua dishipa dia malu masokoka muinshi mua PIPEDA ku Biro bia Mulombodi wa malu a muntu nkayende wa mu Canada (OPC).
• Bukalenge bua ditunga:
• Midimu ya tshimpitshimpi: Ela 999 (anyi 101 / Tshienzedi tshia dishima 0300 123 2040 ne Tshibambalu tshia bukubi bua malu a ordinatere tshia ditunga / NCSC ku ncsc.gov.uk).
• Biro bia mulombodi wa malu a ngumu (ICO - 72-Hour UK GDPR Window): Shi mukanda wa bumanyishi udi mupatuke udi ufila bukenji bua kupeta malu a muntu nkayende a bena mu UK, Kanungu ka 33 ka UK GDPR kadi kalomba bua kumanyisha ICO (0303 123 1113) mu meba 72 a kumanya bualu bua dishipa dia mikenji.
• Buobumue bua matunga a ku Mputu:
• Midimu ya tshimpitshimpi: Ela 112 mu matunga onso adi mu UE.
• GDPR Article 33 & NIS2 Directive Incident Reporting: Malongolodi adi muinshi mua EU GDPR adi ne tshia kukontonona ni dimanyisha dia malu a muntu nkayende divua difikishe ku dishipa dia malu masokoka a muntu (dimanyisha dia mêba 72 kudi mbulamatadi wa ditunga udi ulama malu a bantu / DPA), eku bintu bia mushinga mukole bidi muinshi mua EU NIS2 Mikenji idi ne tshikondo tshia ndekelu tshia didimuija dia meba 24 kudi ditunga diabu CSIRT (BSI mu Allemagne, ANSSI mu France, ACN mu Italie) bua malu manene a ku Enternete.
• Australie ne Nouvelle-Zélande:
• Midimu ya tshimpitshimpi: Ela 000 mu Australie anyi 111 mu Nouvelle-Zélande.
• Tshibambalu tshia bukubi bua ku Enternete tshia mu Australie (ACSC) & Notifiable Data Breaches (OAIC): Kubikila 1300 CYBER1 (1300 292 371) bua kuandamuna ku tshilumbu, ne kukonkonona majitu a dimanyisha muinshi mua Biro bia mulombodi wa malu a ngumu wa mu Australie (OAIC) Dishipa dia mikenji ya malu adibu mua kumanyisha (NDB) scheme anyi New Zealand Privacy Act 2020 (Privacy Commissioner).
• India ne Asia-Pacifique:
• Midimu ya tshimpitshimpi: Ela 112 mu Inde (anyi 1930 bua buenzavi bua ku Enternete).
• CERT-In Mandatory 6-Hour Reporting Directive (India): Muinshi mua Indian Computer Emergency Response Team (CERT-In) njila (No. 20(3)/2022-CERT-In), dibuela dia bantu kabayi banyishibue mu biamu bia mudimu bia mu matutu/IT anyi dipatuka dia malu adi anyanga malongolodi mu Inde didi ne tshia kumanyishibua ku incident@cert-in.org.in mu meba 6 a dimanya.

Nkonko itubu bela misangu ya bungi¶

Ngakajimija .env tshikandakanda ne kutuma tshipungidi tshipiatshipia kunyima kua tusunsa 30 kunyima kua tshilema tshianyi - ndi anu dijinga ne kushintulula mishindu yanyi ya API ne meyi a tshisokomenu anyi?¶

Eyowa, 100 pa lukama - shintulula tshiamu tshionso diakamue kakuyi dishilangana. Malonga a bukubi bua ku Enternete ne telemetrie a mu GitHub Secret Scanning adi ajadika ne: biamu bia mudimu bidi bikuata mudimu bidi bitangila malu adi enzeka mu GitHub (api.github.com/events) mu tshikondo tshilelela ne wangate bintu bipiabipia munda mua 1.5 too ne ku 5 sekonde. Tshibi menemene, kuela tshianza tshibidi tshidi tshijimija .env udi ushiya meyi onso adi kaayi ne bualu .env tshikandakanda tshidi tshisombe kashidi munda mua dishilangana dia malu a kale a tshienzedi tshia kumpala - ne ba-bot ba bungi batu bakeba tshienzedi tshidi tshijimija .env mikanda. Padibu batuma bualu busokoka mu tshilaminu tshia bintu bia bantu bonso nansha bua sekonde umue, budi bunyanguka bua kashidi; kumbusha ne kushintulula tshijadiki tshia ku tshiamu tshia mudimu ke tshintu tshimuepele tshidi tshikukuba.

Netuambe tshinyi bu tshilaminu tshia bintu tshivua tshilaminu tshia GitHub tshia pa nkaya pamvua muenze .env tshikandakanda, ne ndi musue anu kutshisukula kumpala kua kuenza tshilaminu tshia bantu bonso lumingu ludi lulonda anyi?¶

Shi tshilaminu tshia bintu tshivua 100 pa lukama ya pa nkaya tshikondo tshionso (ne kakuvua tshiamu tshia CI/CD tshia bantu bakuabu tshivua katshiyi tshieyemenyibua tshivua ne mushindu wa kubuelamu to), biamu bia scraper pa GitHub Events API bia bantu bonso bivua ne ki ndi mumone tshisokomenu tshieba. Ino, KUFUTHI patupu `.env` mu tshipungidi tshipiatshipia ne pashishe ushintulule tshilaminu tshia bintu kumbukila ku tshia pa nkaya too ne ku tshia bantu bonso. Dîba diudi ushintulula tshilaminu tshia bintu tshia pa nkayebe bua kulua tshia bantu bonso, tshidi tshimfuanyi tshijima tshia malu a kale udi ulua wa bantu bonso - ne biamu bia mudimu bidi bibala diakamue bintu bionso bia kale bidi mu tshilaminu tshipiatshipia tshia bantu bonso. Kumpala kua kuenza tshilaminu tshia pa nkayebe tshia patoke, nansha: (1) Enza git filter-repo --invert-paths --path .env bua kumbusha mukanda ku bintu bionso bia kale (ne kunyungulula tufungu bua kuenza mudimu bimpe), NANSHA (2) Kopa mikanda idi mikezuke mpindieu mu tshilaminu tshipiatshipia, enza tshibangidilu bua 1-commit wa ntuadijilu mukezuke, ne upatule tshilaminu tshipiatshipia atshi.

Bua tshinyi AWS uvua mudisangishe nkayende mikenji idibu babikila ne: AWSCompromisedKeyQuarantineV2 kudi muena mudimu wanyi wa IAM, ne bua tshinyi ndi anu mpeta bitadi?¶

Bualu AWS udi wenza mudimu pamue ne GitHub Secret Scanning, dîba dionso didi AKIA... tshifungu tshidi tshimueneka mu tshipungidi tshia GitHub tshia bantu bonso, tshiamu tshia bukubi tshia AWS tshidi tshitshipeta mu minite mikese, tshiunzulula tike wa diambuluisha, ne tshilamakaja mikenji idibu balombola AWSCompromisedKeyQuarantineV2 (anyi V3) kudi muena IAM au. Mukenji wa diteka bantu pa nkayawu udi ukandika malu a njiwu adi amueneka patoke bu mudi kupatula bintu bipiabipia ec2:RunInstances anyi kumbusha S3 buckets - kadi kena ujikija EC2 instances uvua muena tshinyangu mumane kuenza mu sekonde 60 ya kumpala kumpala kua mikenji milamakaja to, ne kena ujimija bena mudimu ba backdoor IAM anyi ba tshitupa tshîpi to STS bikondo bidi muena tshinyangu mumane kuenza. Udi anu ne tshia kumbusha tshifungu tshidi tshipatuka ku bianza, tangila EC2 Global View mu bitupa bionso bua kujikija malu mabi, ne kutangila CloudTrail bua mashintuluka a IAM adi kaayi maanyishibue.

Ndishilangana kayi didi pankatshi pa git filter-repo ne BFG Repo-Cleaner, ne bua tshinyi tshiena ne bua kuenza mudimu ne git filter-branch?¶

git filter-branch i tshikandakanda tshia kale tshia shell tshienza mu mishindu ya kumpala ya Git tshidi tshienda bitekete bitekete mu nzubu minene ya dilamina bintu, tshipepele bua kutshilongolola bibi (tshishiya bilejilu bia tshilaminu mu refs/original/ udi anu ne malu ebe masokoka.), ne mpindieu udi upatula didimuija dia dijimija dia mudimu dia kudi Git dikuambila bua kubenga kuenza nawu mudimu. Bonsu babidi git-filter-repo (mufunda mu Python ne muanyishibue kudi bena mudimu ba Git ne GitHub) ne BFG Repo-Cleaner (mufunda mu Java/Scala) enza 10x too ne ku 100x lubilu ne funda kabidi bimpe bionso bidibu bafila, mitshi ne bimanyinu. git-filter-repo udi utamba kuikala mutambe buimpe lelu bualu udi ushintulula nansha tshijadiki tshiebe tshia mpindieu (`HEAD`) kakuyi dilomba dia kumpala dia tshipungidi tshia kumpala.

Mmunyi mudi muntu mua kumona tshindi mufute pa GitHub kunyima kua meme mumane kuenza git filter-repo ne git push --force?¶

Mu Git, `git push --force` udi anu ushintulula tshimanyishilu tshia tshitupa (`refs/heads/main`) bua kuleja tshilongo tshieba tshipiatshipia tshifunda tshiakabidi; udi wenza ki diakamue kumbusha bintu bia kale bidi kabiyi bileja ("dangling") bidi bilamibua mu biamu bia mudimu bia GitHub. Shi bot mufunde SHA wa maleta 40 wa tshipungidi tshieba tshia kumpala pavuaye mufike ku API wa malu a bantu bonso, ndaku buludiludi ku https://github.com/owner/repo/commit/<40-char-SHA> neikale anu ne tshia kuenza mudimu ne tshilaminu tshia bintu tshia GitHub too ne padi disangisha dia bintu bia bukoya dijika. Bua kujikija tshimuenekelu tshilama diakamue, anyi kumbusha tshilaminu tshia bintu pa GitHub ne kutshifuka tshiakabidi ku tshilaminu tshieba tshikezuke, anyi kutuma SHA wa dilaya dia ku Dikuatshisha dia GitHub (`support.github.com`) bua dilengeja dia lukasa dia tshisokomenu tshia ku luseke lua tshiamu tshia mudimu.

Netuambe tshinyi shi muntu ukadi muele "Fork" pa tshilaminu tshianyi tshia patoke kumpala kua meme kunyema git filter-repo?¶

Ke bualu kayi Tshitupa 1 tshidi misangu yonso tshia kumbusha ne kushintulula malu adi aleja mudimu ku tshiamu tshia mudimu tshia mufidi wa bintu: munkatshi mua git filter-repo ne kuenzeja bua kuya mu tshilaminu tshieba KAYENA ufunda kabidi malu adibu bafila munda mua Fork wa muntu mukuabu to wa tshilaminu tshieba (pa kumbusha wewe mufute tshilaminu tshieba tshijima ne ubikila bena mudimu ba GitHub bua malu a mushinga mu forks). Paudi umbusha tufungu tua AWS/API ne ushintulula mêyi a tshisokomenu a mu tshilaminu tshia malu, kopi yonso wa kale .env tshikandakanda tshidi munda mua tshilaminu tshia bintu anyi tshilaminu tshia bintu tshidi tshilua tshilongo tshia maleta tshifue, tshidi katshiyi ne mushinga tshidi katshiyi kabidi mua kubuela mu tshiamu tshieba tshia mudimu.

Malu adi apetangana¶

• Ransomware ne malware: dilama dia lukasa ne dipingaja
• Dikuata dia dina dia kazubu, DNS mufue, ne dikuata dia site
• Google Workspace anyi Microsoft 365 custom domain admin lockout ne DNS rescue
• Dishima ne konte minyanguke: dikanga dia tshimpitshimpi
• rm -rf anyi Shift-Delete mu mpukapuka pa Linux, macOS, anyi Windows: dipingaja dia lukasa dia kubala anu
• Nomba ya njiwu bilondeshile ditunga

Miaba ne buludiki bua mbulamatadi¶

• Mikanda ya bukubi ya GitHub (docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository): Kumbusha malu a mushinga mu tshilaminu tshia bintu (git filter-repo, BFG Repo-Cleaner, Dangling Commit Cache Purging, ne Secret Scanning Push Protection).
• Amazon Web Services (AWS) Mukanda wa diandamuna ku njiwu ya bukubi (docs.aws.amazon.com/security/): Kuandamuna ku AWS IAM Access Keys (AWSCompromisedKeyQuarantineV2, Kumbusha tshia tshitupa tshîpi STS Bisangilu kupitshila ku aws:TokenIssueTime, ne CloudTrail Dikonkonona dia malu a mikenji).
• Tshilongelu tshia ditunga tshia mikenji ne bia mudimu (NIST) (États-Unis): Mukanda wa pa buende 800-61 Buakabuluibua 2: Mukanda wa malu a bukubi bua ordinatere ne SP 800-57: Dilomba dia dilombola dia bintu (Dijimija dia mikanda ya dianyisha ne dishintulula dia malu a tshisokomenu).
• Mudimu wa bukubi bua programe ya Internet (OWASP): Secrets Management Cheat Sheet (Preventing Hardcoded Credentials, Pre-Commit Secret Scanning with Gitleaks/TruffleHog, ne Ephemeral Runtime Secret Injection).
• Tshibambalu tshia bukubi bua ku Enternete ne tshia bintu bia mudimu (CISA) (United States): Mukanda wa tshikebelu tshia malu a bukubi mu matutu ne mukanda wa dilongolola dia malu adi kaayi makane.