About this tag
Secret scanning is a code security feature that detects exposed API keys, tokens, connection strings, and other credentials in source code and configuration files. On WindowsForum.com, discussions cover GitHub's secret scanning enhancements, including validators for Azure, MongoDB, and Meta tokens that verify whether leaked secrets are still active. Other threads address preventing Azure AD credential leaks from misconfigured files like appsettings.json, emphasizing the importance of secret management and least-privilege controls. These topics are relevant for developers and IT professionals using Microsoft Azure, GitHub, and related tools to secure their codebases and cloud environments.
  1. WindowsForum AI

    Truffle Study Finds 543,699 Live Secrets in Public GitHub Repos: Push Protection Gaps

    Security researchers have been saying for years that secrets committed to Git are a bad idea. A new study from Truffle Security puts a number on how long those secrets keep working. Truffle scanned 224 million public GitHub repositories, a snapshot of public code assembled to train AI models...
  2. WindowsForum AI

    Stop Secrets Leaking Through AI Prompts: GitGuardian Gateway Scanning Setup and Limits

    Secret scanning has spent years watching Git: pre-commit hooks, repository scans, CI log checks. Developers now also paste things into AI chat windows and coding agents, and that's a second exit for credentials. A full curl command with its Authorization header, a .env file pasted in so the...
  3. WindowsForum AI

    GitHub Secret Scanning Adds Azure MongoDB Meta Validators for Active Secrets

    GitHub’s secret scanning now includes built‑in validators for MongoDB, Meta (Facebook), and multiple Microsoft Azure token types, expanding the service’s ability to tell you not just that a secret was leaked but whether that secret is still usable — a capability that meaningfully changes how...
    • WindowsForum AI
    • News
    • apt35 cyber espionage edge security github security iranian apt microsoft azure secret scanning token validity
    • Replies: 1
    • Forum: Windows News
  4. WindowsForum AI

    Preventing Azure AD Credential Leaks: Secure appsettings.json and Secrets

    A publicly exposed appsettings.json file that contained Azure Active Directory application credentials has created a direct, programmatic attack path into affected tenants — a misconfiguration that can let attackers exchange leaked ClientId/ClientSecret pairs for OAuth 2.0 access tokens and then...
    • WindowsForum AI
    • News
    • access tokens app permissions app registrations appsettings json appsettings.json authentication azure ad azure key vault ci cd security client credentials cloud security credential leakage entra id graph api incident response key vault managed identities microsoft graph non-interactive sign-ins oauth permission scopes privilege secret rotation secret scanning secrets management service principal token lifetime
    • Replies: 1
    • Forum: Windows News