API Key, AWS Secret, or Stripe Live Token Committed to Public GitHub Repo: Automated Bot Scraping in 60 Seconds, Immediate Key Rotation, and Billing Kill-Switch¶

The instant you run git push to a public GitHub, GitLab, or Bitbucket repository (or temporarily flip a private repository to "Public" for even 10 seconds) while a file, .env configuration, Jupyter notebook (.ipynb), or older Git commit history contains a live secret key (such as an AWS Access Key ID starting with AKIA, a Stripe Live Secret Key sk_live_, an OpenAI key sk-proj-, an Anthropic key sk-ant-, or a Google Cloud service account .json), a global network of automated credential-harvesting bots intercepts that secret in 2 to 60 seconds. Because GitHub's public Events API, GH Archive, and real-time webhook firehoses stream every public PushEvent globally, malicious scraper bots parse your diff with regular expressions and begin executing automated cloud commands before you can even type git revert.

Within 90 seconds of an AWS kapena GCP secret hitting a public repo, automated botnets spin up maximum-size GPU/CPU instances (such as p4d.24xlarge or c6i.32xlarge across obscure regions like ap-east-1 Hong Kong, me-south-1 Bahrain, or sa-east-1 Sao Paulo) to mine Monero (XMR), request AWS Simple Email Service (SES) quota increases to blast phishing spam, or clone your private S3 zidebe ndi RDS nkhokwe, kupanga $5,000 to $80,000+ mumtambo phatikiza mabilu usiku. Mofananamo, a zinawukhira OpenAI kapena Anthropic Kiyi ya API imangidwa m'misika yam'munsi ya "reverse-proxy" ya LLM yomwe imawononga madola masauzande ambiri pamakirediti amphindi pamphindi, pomwe idatsikira. Stripe live secret key (sk_live_...) imapatsa oukira mwayi wowerengera / kulemba mwadongosolo kuti abweze ndalama mwachinyengo, makasitomala otumiza kunja PII, kapena yambitsani zolipira za Connect zosaloleka. Ngati wachiwembu akunyengerera gulu lanu pambuyo potulutsa makiyi amakasitomala ndi kiyi yomwe yatsikitsa, funsani apolisi amdera lanu komanso ma hotline omwe achitika pa intaneti kudzera pa manambala angozi chikwatu nthawi yomweyo, ndikuwunikanso maupangiri athu ogwirizana nawo kutsika kwa database yopanga mwangozi, git force-push, ndi kutsitsa kwachinsinsi, nkhokwe yopanga yatsika kapena chidebe cha S3 chachotsedwa popanda zosunga zobwezeretsera zaposachedwa,ndi chitetezo chakutali chakutali ndi zinsinsi za data.

Chitani izi tsopano¶

1. OSATI kuwononga masekondi 60 akuthamanga git rm .env kapena git push --force: PITANI CHIMODZI KWA PROVIDER CONSOL (AWS IAM, Stripe, OpenAI, GCP) NDIPONSO CHONSE/KUTHETSA MAKHIYIWO MU < 30 SECONDS. Kuchotsa fayilo muzochita zatsopano za Git (or even making the GitHub repository Private) amachita **palibe ** kuyimitsa ma bots omwe adakwatula kale kiyi yanu kuchokera ku GitHub Events firehose masekondi 10 apitawo. Chinsinsicho chiyenera kuphedwa poyamba.
2. Ngati ndi AWS kiyi (AKIA... kapena ASIA...) kudawukhira: Tsegulani AWS IAM -> Users -> Security credentials ndikudina **Chotsani / Chotsani ** pa kiyi yolowera nthawi yomweyo, ndikulumikiza AWSCompromisedKeyQuarantineV2(or a blanketKukana *inline policy) kwa wogwiritsa ntchito IAM ndikuwonjezera wogwiritsa ntchito RevokeOldSessions ndondomeko kupha akanthawi iliyonse STS zizindikiro wowukirayo wapangidwa kale (see the exact STS bypass trap below).
3. Ngati a Stripe Live Secret Key (sk_live_... kapena rk_live_...) kudawukhira: Pitani ku dashboard.stripe.com/apikeys, dinani **... -> Perekani kiyi **, ndikukhazikitsa kutha kwa kiyi yakale ku "Tsopano (Immediately) (NOT "in 24 hours"). Nthawi yomweyo fufuzani Stripe Dashboard -> Logs ndi Balance -> Payouts / Refunds kwa mafoni a API osaloleka.
4. Ngati ndi OpenAI, Anthropic, Google Gemini, kapena SendGrid / Twilio kiyi idatsikira: Chotsani kiyi ya API mu dashboard ya operekera nthawi yomweyo ndikukhazikitsa ** Malire Ogwiritsa Ntchito Movuta Mwezi uliwonse ($0 kapena kapu yanu yabwinobwino)** m'makonzedwe a Billing kuti muchepetse zopempha zosewerera mundege.
5. **Sesani Magawo ONSE Amtambo (especially disabled/opt-in regions) pazochitika zachinyengo za EC2, ntchito za Lambda, ntchito za ECS, zidebe za S3, ndi ogwiritsa ntchito a IAM akumbuyo omwe amapangidwa ndi bot pawindo la mphindi ziwiri.like Stockholm eu-north-1, Osaka ap-northeast-3, or Mumbai ap-south-1) ndikupanga wogwiritsa wachiwiri wobisika wa IAM (or SSH key pair) so they can stay inside your account after you delete the leaked key.
6. Pokhapokha chinsinsicho chikathetsedwa ndipo maakaunti a IAM akumbuyo achotsedwa, sukani zomwe Git adachita (using git-filter-repo) NDI kulumikizana ndi GitHub Support (or remove cached PR/commit views) kuti muchotse zosungika za SHA zolendewera, kenako perekani AWS / GCP Mwangozi Wochotsa Maliliro Ochotsa Maliliro ngati bots italipira bilu yayikulu yamtambo.

Mtengo wachigamulo: 60-Second Emergency Response by Leaked Secret Type¶

Tsatirani ndondomeko ya zomwe zachitikazi kuti muphe mbiri yomwe yasokonekera, kulimbikira kwa owukira, ndikubweza ndalama zomwe zawonongeka pamtambo.

flowchart TD
    A["Chinsinsi Chamoyo Choperekedwa kwa Public GitHub / GitLab Repo (.env, Source Code, kapena git History)"] --> B["CHACHIWIRI 0 MPAKA 30: OSATI Kuthamanga git rm Choyamba. Tsegulani Cloud/API Provider Console & REVOKE Key Pompopompo"]
    B --> C{"Ndi mtundu wanji wa mbiri yomwe idawululidwa?"}
    C -->|"1. AWS Access Key (AKIA... / ASIA...)"| D["1. Chotsani / Chotsani Chinsinsi mu IAM 2. Gwirizanitsani Inline 'Deny All' Policy kwa Wogwiritsa (Ikupha Minted STS Tokens) 3. Audit CloudTrail for Backdoor IAM Users"]
    C -->|"2. Stripe Live Secret Key (sk_live_... / rk_live_...)"| E["1. Roll Key with Expiration = 'Momwemo' 2. Yang'anani /v1/kubwezerani ndalama, /v1/transfers & Mapeto a Webhook 3. Unikani Kuwonekera kwa Makasitomala PII"]
    C -->|"3. OpenAI (sk-proj-...), Anthropic (sk-ant-...), kapena Gemini Key"| F["1. Chotsani Kiyi mu Developer Console 2. Lower Organization Hard Billing Cap mpaka $0 Pakanthawi 3. Chongani Logos Kagwiritsidwe kwa Token Drain"]
    C -->|"4. Database URI (postgres://, mongodb+srv://) kapena Redis URL"| G["1. Tembenuzani Mawu Achinsinsi a DB Nthawi yomweyo 2. Thamangani pg_terminate_backend() / KILL kuti Mugwetse Malumikizidwe Okhazikika 3. Tsekani Gulu Lachitetezo ku VPC IPs Pokha"]
    D --> H["Thamangani Multi-Region Compute Sweep (Imitsani Rogue EC2/EKS/SageMaker/Lambda m'zigawo Zonse 30+)"]
    E --> I["Purge Git History kudzera 'git filter-repo' + Chotsani GitHub Cached Commit SHA Views"]
    F --> I
    G --> I
    H --> J{"Kodi ma bots odzipangira okha adakweza $1,000 mpaka $100,000+ yamtambo?"}
    J -->|"INDE"| K["Tsegulani Mlandu Wothandizira Kulipira kwa AWS/GCP -> Tumizani Kuwunika kwa Chitetezo cha Pambuyo-Kukonzanso + Pemphani Nthawi Imodzi Mwachikhulupiriro cha Chinyengo / Kukhululukidwa kwa Bili"]
    J -->|"AYI"| I

Gawo 1: Provider-by-Provider Kill-Switch & Forensics Matrix (First 5 Minutes)¶

Gwiritsani ntchito tebulo ili kuti mupeze batani lochotseratu, machitidwe a GitHub Secret Scanning, ndi vekitala yobisika ya mbiri yanu yotsatsira.

Gawo 2: Kuzama Kwambiri: Momwe Mungathamangitsire Wowononga Mu Akaunti Yanu ya AWS (The 4-Step Cloud Eviction Protocol)¶

Chifukwa zinawukhira AWS zizindikiro zimakhala ndi ma radius apamwamba kwambiri azachuma (up to $50,000+ per day in EC2/SageMaker/Bedrock bills), muyenera kuchita masitepe onse anayi pansipa nthawi iliyonse AKIA... kapena ASIA... key ikugunda malo osungira anthu:

+-----------------------------------------------------------------------------+
|     ANATOMY OF A 60-SECOND AUTOMATED AWS GITHUB SCRAPER BOT ATTACK          |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [ SEC 00 ] Developer runs 'git push origin main' with .env (AKIA...)       |
|       |                                                                     |
|  [ SEC 04 ] Bot scrapes GitHub Events API Firehose -> Extracts AKIA key     |
|       |                                                                     |
|  [ SEC 06 ] Bot calls 'sts:GetCallerIdentity' & 'sts:GetSessionToken'       |
|       |     (Mints temporary ASIA... token that survives AKIA deletion.)    |
|       v                                                                     |
|  +----+------------------------------------------------------------------+  |
|  | [ SEC 15 TO 90: PARALLEL MULTI-REGION EXPLOITATION ]                  |  |
|  |  1. Persistence: Calls 'iam:CreateUser' / 'iam:CreateAccessKey'       |  |
|  |     (Creates hidden user 'aws-support-backup' with AdministratorAccess)|  |
|  |  2. Compute Abuse: Launches Auto-Scaling Groups of c6i.32xlarge /     |  |
|  |     g5.48xlarge in 12 regions + AWS Bedrock / SageMaker LLM endpoints |  |
|  |  3. Spam Abuse: Calls 'ses:PutAccountSendingAttributes' (50k emails)  |  |
|  |  4. Data Exfiltration: Lists & downloads S3 buckets / RDS snapshots   |  |
|  +-----------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------+

Khwerero 1: Iphani Onse Okhazikika AKIA Key NDI Zonse Zopangidwa ASIA Zizindikiro za Gawo¶

Kuchotsa AKIA kiyi mu AWS Console si**** imalepheretsa kwakanthawi STS zidziwitso zomwe zidaperekedwa kale ndi sts:GetSessionToken. Kupha chilichonse nthawi yomweyo kudzera pa AWS CLI (using a separate clean admin profile):

# 1. Delete the compromised Access Key immediately
aws iam delete-access-key --user-name CompromisedUser --access-key-id AKIAIOSFODNN7EXAMPLE

# 2. Attach an explicit 'Deny All' inline policy to the IAM User to immediately
#    invalidate any STS tokens minted by that user AND block all further actions:
aws iam put-user-policy --user-name CompromisedUser --policy-name EmergencyKillSwitch \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*"
    }]
  }'

Khwerero 2: Hunt Down Backdoor IAM Users, Maudindo, ndi Access Keys mu CloudTrail¶

Thamangani malamulo awa a AWS CLI kuti muwone ngati bot idapanga wogwiritsa ntchito wa IAM wobisika kapena adayika kiyi yachiwiri ku akaunti yanu yomwe ilipo pawindo:

# List all IAM users created recently across the account
aws iam list-users --query 'Users[?CreateDate>=`2026-10-30`].[UserName,CreateDate]' --output table

# Audit CloudTrail for every API call made by the compromised user in the last 24 hours
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=CompromisedUser \
  --max-results 50 \
  --query 'Events[].[EventTime,EventName,EventSource]' --output table

Gawo 3: Sesani Zonse 30+ Zigawo za AWS za Rogue EC2 Instances, Auto Scalling Groups, ndi Bedrock/SageMaker Jobs¶

Chifukwa chiyani ozunzidwa amalandilabe a $12,000 bilu kumapeto kwa mwezi "atawona dashboard ya EC2 ndikuwona ziro"? Chifukwa AWS Console imangowonetsa **dera limodzi panthawi ** (e.g., us-east-1), pamene bot inazungulira 20 zochitika mu ap-south-1 (Mumbai), eu-north-1 (Stockholm), ndi sa-east-1 (Sao Paulo), ndi kuwabisa mkati EC2 Auto Scaling Groups (ASGs) kotero kuti mukathetsa EC2 pamanja, Auto Scaling Group iyambitsa ina. 30 seconds kenako.

Thamangani liner yamitundu yambiri iyi kuti mulembe zonse zomwe zikuchitika kapena zomwe zikudikirira EC2 kudera lililonse la AWS 10 seconds:

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "=== Checking Region: $region ==="
  aws ec2 describe-instances --region "$region" \
    --filters "Name=instance-state-name,Values=running,pending,stopped" \
    --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,LaunchTime]' \
    --output table
done

Gawo 3: Kusanthula Chinsinsi Kuchokera ku Mbiri ya Git (git-filter-repo) & Kutsuka Cache Yobisika ya GitHub¶

Chidziwitso chikafa pamsinkhu wopereka chithandizo, muyenera kuchotsa chingwe chachinsinsi pankhokwe yanu .git perekani mbiri yakale kotero kuti ogwira nawo ntchito kapena otsogola amtsogolo sangawone (and so GitHub's Push Protection stops blocking your branches).

1. Chifukwa chiyani? git rm .env + git commit Sichimachotsa Chinsinsi ku Git¶

Kuthamanga git rm .env && git commit -m "remove env" amangochotsa fayilo ku kudzipereka kwaposachedwa (HEAD; chinsinsi chodziwika bwino chimawerengedwa mpaka kalekale mkati mwa zomwe makolo adachita (the parent commit) kwa aliyense amene amadina "Kudzipereka" pa GitHub.

2. Lembaninso Mbiri Yakusungiramo Mwaukhondo git-filter-repo¶

1. Ngati kudzipereka komaliza (HEAD) munali chinsinsi (and nobody else has pulled it yet):

   # Remove the sensitive file from the staging index while keeping it on your local disk
   git rm --cached .env
   echo ".env" >> .gitignore
   git add .gitignore
   git commit --amend --no-edit
   git push --force-with-lease origin main
   

2. Ngati chinsinsi chakwiriridwa zinthu zingapo m'mbiri yanu (or inside a code file you want to keep): Gwiritsani git-filter-repo(the official, fast replacement recommended by Git and GitHub instead of the deprecated git filter-branch):

   # Option A: Completely purge a file (.env) from every commit in history
   git filter-repo --path .env --invert-paths --force
   
   # Option B: Replace a specific secret string with '***REMOVED***' across all files in history
   echo "sk_live_51NzExampleSecretKey12345==>***REMOVED***" > expressions.txt
   git filter-repo --replace-text expressions.txt --force
   
   # Force-push the rewritten history to GitHub across all branches and tags
   git push origin --force --all
   git push origin --force --tags
   

3. Msampha Wobisika wa GitHub Cache (Dangling Commit SHAs)¶

Ngakhale mutathamanga git filter-repo ndi git push --force, Maseva apaintaneti a GitHub amasungabe zakale, zosawerengeka ("zolendewera") kuti SHA ikhale yamoyo komanso kupezeka pagulu https://github.com/<owner>/<repo>/commit/<old-40-char-sha>(and in any forks or Pull Requests) mpaka kusonkhanitsa zinyalala kutha. - Momwe Mungachotsere SHA Yosungidwa pa GitHub Pompopompo: 1. Koperani zonse 40-character perekani SHA pazomwe zatsitsidwa musanalembenso mbiri. 2. Tsegulani https://support.github.com/contact -> funsani ku "Chotsani zidziwitso zachinsinsi / Chotsani mawonedwe osungidwa pakupanga kosafikirika kwa SHA" m'malo owner/repo ndikupereka SHA yeniyeni (or use the GitHub Support portal's automated cache-purge workflow).

Gawo 4: Momwe Mungapezere a $5,000 to $100,000+ AWS kapena GCP Bot Bill Wayimitsidwa (The Courtesy Forgiveness Appeal)¶

Bwanji ngati mutakankhira .env Lachisanu masana, sindinayang'ane imelo yanu mpaka Lolemba m'mawa, ndikudzuka ku $28,400.00 AWS kapena Google Cloud bill kuchokera ku crypto-mining kapena LLM-proxy bots?

OSATI kuchita mantha, ndipo OSATI kuletsa kirediti kadi kapena kubweza chibwezero kubanki. Onse Amazon Web Services (AWS) ndi Google Cloud Platform (GCP) khalani ndi zokhazikitsidwa zamkati Kusintha kwa Maliliro a Nthawi Imodzi Mwangozi Mwadzidzidzi / Ndondomeko Yakulipira Mwachilolezo kwa omanga, ophunzira, ndi oyambitsa, *ngati ** mwamaliza 100% pamndandanda wawo wovomerezeka wokonzanso chitetezo * pamaso gulu lawo lowunika mabilu liwunikenso pempho lanu.

5-Step AWS / GCP Bill Waiver Protocol (90%+ Success Rate for First-Time Leaks)¶

1. ** Malizitsani Gawo Lonse Lokonzekera Chitetezo (AWS Will Reject Your Waiver Until the Account Is Clean):**
   • Chotsani kiyi yofikira ya IAM (and the IAM User if possible).
   • Chotsani zochitika zilizonse zosaloledwa za EC2, Auto Scalling Group, voliyumu ya EBS, Elastic IP, chitsanzo cha RDS, ndi ndowa ya S3 kudutsa magawo onse (verify via AWS Cost Explorer and AWS Billing -> Bills -> Charges by Region that daily accrual has dropped back to $0.00).
   • Yambitsani Hardware kapena Authenticator App MFA (Multi-Factor Authentication) pa AWS Root Account yanu ndi wogwiritsa ntchito aliyense wa IAM.
2. Tsegulani Nkhani Yothandizira Pansi "Account and Billing" (Free for All AWS/GCP Tiers, No Paid Support Plan Required):
   • Pitani ku console.aws.amazon.com/support/home -> Pangani mlandu -> Akaunti ndi kubweza -> Ntchito: Maliliro -> Gulu: Kanizani Chilichonse / Akaunti Yowonongeka.
3. Tumizani Chidule Chachidule Chowona Chothetsera & Pazovuta:
   • Vomerezani Nthawi Yanthawi & Choyambitsa: Nenani momveka bwino pamene kiyi idawululidwa mwangozi pa GitHub (e.g., "October 30 at 22:14 UTC") ndipo pamene idachotsedwa ("October 31 at 09:05 UTC").
   • Itemize The Unlosed Charges by Region & Service: Lembani ndalama zenizeni za dola zachinyengo za bot motsutsana ndi bilu yanu yanthawi zonse yamwezi pamwezi (e.g., "My normal monthly AWS bill for the past 8 months is $14.50/month in us-east-1; the unauthorized charges total $18,420.12 across ap-east-1, eu-north-1, and sa-east-1 EC2/Bedrock usage").
   • Tsimikizirani Kukonzanso 100%: Lozani masitepe enieni omwe mwamaliza kale (1. Deleted IAM key AKIA...; 2. Terminated all unauthorized resources across all regions; 3. Audited CloudTrail for backdoor users; 4. Enabled Root & IAM MFA; 5. Configured AWS Budgets alerts).
   • Pemphani Mwaulemu Kusintha Kwa Maliliro Kwanthawi Imodzi: Fotokozani kuti ndinu wopanga / wophunzira / woyambitsa koyambirira, yemwe amalipira $18,420 bilu yosaloleka ya bot ingabweretse mavuto azachuma, ndikufunsa ngongole yolipiritsa nthawi imodzi/kusiya pakugwiritsa ntchito mwachinyengo.
4. Sinthanani kwakanthawi kapena sungani Khadi Lanu Lolipirira Lolumikizidwa Ngati Kulipiritsa Kuli Pafupi:
   • Pomwe mlandu wanu wa AWS Billing Support ukuwunikidwa (which usually takes 5 to 15 business days pomwe AWS Security and Billing Service Teams amatsimikizira kuti zida zonse zachipongwe zathetsedwa), funsani AWS Support mkati mwa tikiti ndikuwafunsa kuti ayike ndalama kwakanthawi (defer auto-charge) pa invoice yomwe mukutsutsidwayo kuti isawononge ndalama zambiri ku akaunti yanu yakubanki pamene kusintha kwangongole kukukonzedwa.

• (Pazinthu zofananira ndi zochitika zachitetezo chakutali, onani Kutsika kwa database yopanga mwangozi, git-push-push, kutayikira kwachinsinsi, ndi kuyeserera zochitika, Nawonsowake yopanga yatsika kapena chidebe cha S3 chachotsedwa popanda zosunga zobwezeretsera zaposachedwa, Mwangozi adatumiza maimelo achinsinsi, kasitomala PII, kapena HIPAA spreadsheet,ndi Chitetezo chakutali kuntchito zadzidzidzi komanso zinsinsi za data.)*

Kuphwanya kwa data m'chigawo ndi maulamuliro ofotokozera chitetezo chamtambo¶

Mafunso omwe amafunsidwa pafupipafupi¶

Ngati ndidazindikira kuti ndikukankha .env Fayilo kupita ku GitHub repo yapagulu ndikupanga repo kukhala chinsinsi patatha mphindi 2, kodi ndikufunikabe kutembenuza makiyi anga?¶

Inde, makiyi 100 pa 100 aliwonse omwe ali mufayiloyo ayenera kuganiziridwa kuti asokonezedwa ndikuchotsedwa nthawi yomweyo. Maboti odzitchinjiriza odzitchinjiriza samadikirira kuti Google iwonetsere malo anu; amalembetsa mwachindunji ku GitHub's real-time public `Events API` moto wamoto (`and GH Archive`), yomwe imawulutsa anthu onse `PushEvent` Padziko lonse lapansi mkati mwa masekondi 1 mpaka 3 kuchokera nthawi yanu `git push`. Panthawi yomwe mudadina "Zikhazikiko -> Sinthani mawonekedwe -> Pangani zachinsinsi" patatha mphindi ziwiri, ma bots ambiri odzipangira okha anali atatsitsa kale diff yanu ndikuyika mbiri yanu ya AWS, Stripe, OpenAI, ndi database yanu kuti mugwiritse ntchito.

Chifukwa chiyani bots idapitilira kuyambitsa zochitika za EC2 muakaunti yanga ya AWS ngakhale nditachotsa zomwe zidatsitsidwa AKIA kiyi yolowera?¶

Kuchotsa static `AKIA...` kiyi yofikira mu AWS IAM imangoyimitsa kiyi yeniyeniyo; sichimalepheretsa kwakanthawi `ASIA...` Service Chizindikiro chachitetezo (`STS`) zizindikiro zagawo zomwe wowukirayo wapanga kale kugwiritsa ntchito `sts:GetSessionToken` kapena `sts:AssumeRole` masekondi angapo oyamba mutatha kukwapula kiyi yanu (`which remain valid for up to 12 to 36 hours`). Kuphatikiza apo, zolemba zowukira za AWS zimayimba nthawi zonse `iam:CreateUser` ndi `iam:CreateAccessKey` mu sekondi yawo yoyamba yofikira kubzala yachiwiri, akaunti yobisika yoyang'anira pakhomo. Kuti muyimitse kulowerera kwa AWS kwathunthu, muyenera kuchotsa `AKIA` key, phatikizani momveka bwino `Deny *` ndondomeko yapaintaneti kwa wogwiritsa ntchito wa IAM (`which immediately invalidates all minted STS tokens`), ndikuwunika CloudTrail kwa ogwiritsa ntchito atsopano a IAM kapena maudindo.

Kodi AWS kapena Google Cloud ikhululuka kwambiri $10,000+ bilu ngati obera adaba kiyi yanga ya API kuchokera ku GitHub ndi crypto migodi?¶

Pazambiri zochulukira mwangozi koyamba, inde, ngati mutachitapo kanthu mwachangu, mutagwirizana mokwanira ndi gulu lawo lachitetezo, ndipo musanyalanyaze ma invoice. Onse a AWS ndi Google Cloud ali ndi ndondomeko yosinthira nthawi imodzi mwaulemu kwa omanga ndi mabizinesi ang'onoang'ono omwe akhudzidwa ndi ma spikes osaloleka. Musanapemphe kuchotsedwa kwa biluyo pansi pa chithandizo cha "Akaunti ndi Kulipira", choyamba muyenera kutsimikizira kuti kutayikirako kwatsekedwa ndi 100 peresenti: chotsani makiyi a IAM owonekera, kuthetseratu zochitika zonse zachinyengo ndi Magulu Owonjezera Magalimoto kumadera onse 30+ apadziko lonse lapansi, yambitsani Multi-Factor Authentication (`MFA`) pa akaunti yanu ya mizu, ndikukhazikitsa zidziwitso zamtengo wa AWS Budgets.

Chifukwa chiyani? git rm .env osachotsa kiyi yanga yachinsinsi ku GitHub?¶

Git ndi leja yosasinthika yowongolera: mukathamanga `git rm .env` ndikukankhira kudzipereka kwatsopano, Git amangolemba kuti fayiloyo kulibe mu chithunzi chatsopano kwambiri (`HEAD`), ndikusunga zonse zomwe zili m'nkhaniyi `.env` kusungidwa kwamuyaya mkati mwa zomwe zidachitika kale (`the parent commit`) m'mbiri yanu yosungiramo zinthu zakale. Ngakhale mutalembanso mbiri yanu ndi `git filter-repo` ndi kukankha mokakamiza, aliyense angathebe kuwerenga chinsinsi ngati simunachichotse pa wothandizira wothandizira. Nthawi zonse bweza ndikutembenuza kiyi yachinsinsi mu dashboard yanu ya mtambo kaye, kenako gwiritsani ntchito `git filter-repo` kuti muchotse chingwe chakufa kuchokera ku mbiri yanu yodzipereka.

Maupangiri ogwirizana¶

• Kutsika kwa database yopanga mwangozi, git-push-push, kutayikira kwachinsinsi, ndi kuyeserera zochitika
• Nawonsowake yopanga yatsika kapena chidebe cha S3 chachotsedwa popanda zosunga zobwezeretsera zaposachedwa
• Mwangozi anatumiza imelo yachinsinsi ya malipiro, kasitomala PII, kapena HIPAA spreadsheet kwa wolandira molakwika
• Gawo lowonekera mwangozi lamasamba achinsinsi amalipiro, woyang'anira mawu achinsinsi, kapena mndandanda wantchito pa Zoom/Magulu
• Chitetezo chakutali kuntchito zadzidzidzi komanso zinsinsi za data
• Nambala zangozi

Magwero ndi malangizo ovomerezeka¶

• ** Amazon Web Services (AWS Security Incident Response Guide & AWS Knowledge Center: "What should I do if I notice unauthorized activity or exposed IAM access keys?"):**AWSCompromisedKeyQuarantineV2 Makhalidwe a Ndondomeko, Kusavomerezeka Kwakanthawi STS Zizindikiro za Gawo (RevokeOldSessions), ndi Multi-Region Resource Auditing.
• ** Zolemba za GitHub (GitHub Secret Scanning, Push Protection, & "Removing sensitive data from a repository" using git-filter-repo):** Partner Auto-Revocation Program (Stripe, AWS, OpenAI, NPM), git-filter-repo Kulembanso Mbiri Yakale, ndi Kutsuka Zosungidwa Zosungidwa Zosafikirika za SHAs.
• Stripe Inc.Stripe Developer Security Guide: API Key Rotation & Compromised Key Incident Triage): Pomwepo sk_live_ Kutha Kwachangu, Kuwunika /v1/events ndi /v1/webhook_endpoints, ndi Kuletsa Makiyi kudzera rk_live_ Zokwanira.
• NIST (Special Publication 800-61 Rev. 2 / Rev. 3: Computer Security Incident Handling Guide) & OWASP (Secrets Management Cheat Sheet): Credential Containment, Ephemeral OIDC Workload Identity Federation (replacing static CI/CD keys), ndi Pre-Commit Secret Scanning.