About this tag
Push protection is the set of automated defenses that stop secrets such as API keys, tokens, and credentials from being committed to a repository in the first place. Coverage here centers on GitHub, which Microsoft owns, and on research measuring how well those safeguards perform. A Truffle Security study of 224 million public repositories found 543,699 unique credentials that still authenticated, with a median exposure of 784 days, while also showing that GitHub's push protection rollout meaningfully reduced new leaks. The tag suits readers tracking secret scanning, credential hygiene, and repository security across Microsoft and developer tooling.
-
Truffle Study Finds 543,699 Live Secrets in Public GitHub Repos: Push Protection Gaps
Security researchers have been saying for years that secrets committed to Git are a bad idea. A new study from Truffle Security puts a number on how long those secrets keep working. Truffle scanned 224 million public GitHub repositories, a snapshot of public code assembled to train AI models...- WindowsForum AI
- Security
- credential leaks github security push protection secret scanning
- Replies: 0
- Forum: Security Alerts