Top all-time · #1702
GitGuardian Blog
Company blog · blog.gitguardian.comsecurity
GitGuardian Blog is the company blog at blog.gitguardian.com, writing about security. Since 2018, 43 different Hacker News readers have linked it 103 times, most often “Docker container security cheat sheet”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers link GitGuardian's blog for posts on leaked secrets and hardcoded credentials, including breach write-ups (Uber, Dropbox) and remediation guides. Comments mostly cite or link them as sources.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A blog for developers, Application Security and other cybersecurity professionals to learn about secrets in source code, API security, IaC and DevSecOps.
Most-linked posts?
- Docker container security cheat sheet4 people · 4 mentions · first linked 2021-07-30
- Toyota suffered a data breach by accidentally exposing a secret key on GitHub3 people · 3 mentions · first linked 2022-10-12
- The State of Secrets Sprawl 20252 people · 2 mentions · first linked 2025-03-13
- Separating work and personal Git accounts on your laptop2 people · 2 mentions · first linked 2021-10-29
- Millions of .git folders exposed publically by mistake2 people · 2 mentions · first linked 2022-11-09
- Building internal secrets detection: how SAP scans Git repos for secrets2 people · 2 mentions · first linked 2020-10-08
- Demystifying Docker: Understanding and Optimizing Your Images2 people · 2 mentions · first linked 2025-01-09
- GitHub Exposed a Private SSH Key: What You Need to Know2 people · 2 mentions · first linked 2023-03-27
- /dropbox-breach-hack-github-circleci/2 people · 2 mentions · first linked 2022-11-02
What Hacker News says?
That hardcoded secret in the powershell script really was the key to the Uber ride-hailing kingdom – https://blog.gitguardian.com/uber-breach-2022 .
Comment linking /uber-breach-2022
on “Uber investigating breach of its computer systems”Submitted Toyota suffered a data breach by accidentally exposing a secret key on GitHub as a story · 589 points
HN discussionHere's a checklist [1] (again, from gitguardian) of steps to follow before open-sourcing projects and [2] a guide on how to remediate hardcoded/exposed secrets. [1] https://blog.gitguardian.com/safely-open-source-software-bes... [2] https://blog.gitguardian.com/leaking-secrets-on-github-what-...
Comment linking /leaking-secrets-on-github-what-to-do/
on “Toyota suffered a data breach by accidentally exposing a secret key on GitHub”Submitted Best practices for managing and storing secrets like API keys and credentials as a story · 200 points
HN discussionUnfortunately, it's not as simple as that. Lots of secrets are "generic" (think of a DB user/password combination), meaning that you need to take into account the surrounding source code context to be able to determine if they are a "real" secret. Here is a full explanation if you are interested: https://blog.gitguardian.com/why-detecting-generic-credentia...
Comment linking /why-detecting-generic-credentials-is-a-game-changer/
on “Billion-record stolen Chinese database for sale on breach forum”Submitted Docker container security cheat sheet as a story · 192 points
HN discussionA few days before this attack campaign started, I wrote a guide to help security and engineering teams prioritize and remediate thousands of secrets-in-code incidents. Hope it can help some of the organizations dealing with this right now! https://blog.gitguardian.com/a-practical-guide-to-prioritize...
Comment linking /a-practical-guide-to-prioritize-and-remediate-thousands-of-secrets-leaks-incidents/
on “Heroku Security Notification”Submitted Using Git hooks for automated secrets detection as a story · 23 points
HN discussionA few days before this attack campaign started, I wrote a guide to help security and engineering teams prioritize and remediate thousands of secrets-in-code incidents. Hope it can help some of the organizations dealing with this right now! https://blog.gitguardian.com/a-practical-guide-to-prioritize...
Comment linking /a-practical-guide-to-prioritize-and-remediate-thousands-of-secrets-leaks-incidents
on “Attack campaign involving stolen OAuth tokens issued to third-party integrators”Submitted Why secrets like API keys in Git are such a problem as a story · 14 points
HN discussionIt was just an example. It used to be fairly common for people to sync some of their dotfiles via git, and from time to time someone would leak a directory that contained sensitive data without them realizing it. I'd guess things like tokens used by cli tools were more common than whole .ssh directories, but I'm sure both happened. Not quite the same thing, but also a leak: https://blog.gitguardian.com/github-expose…
Comment linking /github-exposed-private-ssh-key/
on “xAI dev leaks API key for private SpaceX, Tesla LLMs”Submitted Love, Death and PostgreSQL Triggers (2022) as a story · 13 points
HN discussion"70% of secrets leaked in 2022 remain valid today"[1] is a quote that should help understand the situation. [1] https://blog.gitguardian.com/the-state-of-secrets-sprawl-202...
Comment linking /the-state-of-secrets-sprawl-2025/
on “I scanned all of GitHub's "oops commits" for leaked secrets”Submitted Supply Chain Attacks: 6 Steps to protect yourself as a story · 13 points
HN discussion* The hardening of images is pretty important: https://blog.gitguardian.com/how-to-improve-your-docker-cont... * Working out/testing how upgrades can be made to ingresses without downtime * Designing and testing SSL cert rotation * Having a strategy for image version updates (e.g. not using "latest" but how to decide when an upgrade to a newer image is or isn't acceptable) * How to super-optimise layering or image b…
Comment linking /how-to-improve-your-docker-containers-security-cheat-sheet/
on “Ask HN: What is the fastest way to ramp up on DevOps, k8 and GCP?”Submitted Guardian Goofs: Signs Your Developers Are Leaking Secrets as a story · 11 points
HN discussionAnother take: https://blog.gitguardian.com/dropbox-breach-hack-github-circ...
Comment linking /dropbox-breach-hack-github-circleci/
on “How we handled a recent phishing incident”Submitted One year and a half scanning GitHub for sensitive data as a story · 10 points
HN discussionsome details on this breach: https://blog.gitguardian.com/dropbox-breach-hack-github-circ...
Comment linking /dropbox-breach-hack-github-circleci/
on “Dropbox admits 130 of its private GitHub repos were copied after phishing attack”Submitted What Happened in the U.S. Department of the Treasury Breach? A Detailed Summary as a story · 8 points
HN discussionhttps://blog.gitguardian.com/crappy-code-crappy-copilot/ https://news.ycombinator.com/item?id=39168105 There is plenty of evidence that none of this code is good. Github is now deep into the MS copilot shitty hype machine cycle. You have been warned that M$ gonna M$.
Comment linking /crappy-code-crappy-copilot/
on “AI Is Rewiring Coders' Brains. Yours May Be Next”Submitted How to scan local files for secrets in Python using the GitGuardian API as a story · 8 points
HN discussionDirect article link: https://blog.gitguardian.com/exposed-git-folders-exposed/
Comment linking /exposed-git-folders-exposed/
on “Millions of .git folders exposed publically by mistake – New research shows”Submitted Toyota Exposed Secret Key Publicly on GitHub for Five Years Causing a Data Leak as a story · 7 points
HN discussionIf the numbers look suspicious to you, I would suggest you check what is found more specifically about your company/organization. GitGuardian can provide an automatic audit of your company-specific leaks we found on GitHub. Just ask: https://www.gitguardian.com/complimentary-audit-secrets-leak... More details on how it works: https://blog.gitguardian.com/github-secrets-leak-free-audit/
Comment linking /github-secrets-leak-free-audit/
on “1 in 10 developers leaked an API-key in 2022”Submitted Demystifying GitHub Private Forks – The Hidden Danger of Cached View as a story · 6 points
HN discussionThe other day I wrote a guide to help security and engineering teams prioritize and remediate thousands of such incidents. Hope it helps! https://blog.gitguardian.com/a-practical-guide-to-prioritize...
Comment linking /a-practical-guide-to-prioritize-and-remediate-thousands-of-secrets-leaks-incidents
on “Surviving the GitHub OAuth hack – remediating thousands of hardcoded credentials”Submitted Millions of .git folders exposed publically by mistake as a story · 6 points
HN discussionBasically, rotate as soon as you can* and start looking through your AWS logs and setting to see if any services you don't recognize have been spun up. Is you think you have been attacked or see stuff you did not spin up, contact AWS support ASAP! *Do NOT just revoke keys if it is in a production system where other people are working or are depending on. Talk to your team and figure out what the remediation process…
Comment linking /thinking-like-a-hacker-aws-keys-in-private-repos/
on “What happens when you leak AWS credentials and how AWS minimizes the damage”Submitted Separating work and personal Git accounts on your laptop as a story · 6 points
HN discussion
