---
title: "Exposed Secrets - GitHub"
canonical: "https://kb.cynergy.app/space/MD/899416391/Exposed%20Secrets%20-%20GitHub"
format: markdown
---
**Description**

Attackers are constantly monitoring and scanning public git repositories for secrets,  GitHub has a public API where you can monitor every single git commit that is made. That means that attackers can (and they do) monitor the API to find credentials and sensitive information within repositories. For this reason, it is best to assume that if you have leaked a secret, it is compromised forever.

**Hacker's View**

As a hacker, I will use the GitHub API and look for publicly exposed secrets and API keys. once identified I will use them to get into the accounts and possibly use them to breach the organization or alternatively use the API keys for self-consumption or resell them on the Darknet. 

**Mitigation**

The mitigation for a leaked credentials incident is divided into two parts:

- Immediate action -
  - Delete the Git-Hub entry of the API key or sensitive information
  - Rotate the key or generate a new key - assume that once leaked, someone has already found and possibly used the API key

**Cynergy’s View**

Cynergy constantly collects and indexes leaked sensitive data from GitHub, Cynergy has a unique algorithm that tries to identify and validate the sensitive data, to reduce the false positive alerts. 

Scan for data leaks now.

![image](media://de212001-b3cc-41d2-b554-30d1ea43887d)


**Reference:**

GitHub - [https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning](https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning) 

GitHub - [https://docs.github.com/en/enterprise-cloud@latest/rest/secret-scanning](https://docs.github.com/en/enterprise-cloud@latest/rest/secret-scanning)