#gitguardian — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #gitguardian, aggregated by home.social.
-
📬 CISA blamiert sich mit offenem GitHub-Repo voller Passwörter und AWS-Keys
#Artikel #AWSZugangsdaten #BrianKrebs #CISA #GitGuardian #GitHubToken #GuillaumeValadon #Sicherheitsbehörde https://sc.tarnkappe.info/c12485 -
📬 CISA blamiert sich mit offenem GitHub-Repo voller Passwörter und AWS-Keys
#Artikel #AWSZugangsdaten #BrianKrebs #CISA #GitGuardian #GitHubToken #GuillaumeValadon #Sicherheitsbehörde https://sc.tarnkappe.info/c12485 -
📬 CISA blamiert sich mit offenem GitHub-Repo voller Passwörter und AWS-Keys
#Artikel #AWSZugangsdaten #BrianKrebs #CISA #GitGuardian #GitHubToken #GuillaumeValadon #Sicherheitsbehörde https://sc.tarnkappe.info/c12485 -
📬 CISA blamiert sich mit offenem GitHub-Repo voller Passwörter und AWS-Keys
#Artikel #AWSZugangsdaten #BrianKrebs #CISA #GitGuardian #GitHubToken #GuillaumeValadon #Sicherheitsbehörde https://sc.tarnkappe.info/c12485 -
📬 CISA blamiert sich mit offenem GitHub-Repo voller Passwörter und AWS-Keys
#Artikel #AWSZugangsdaten #BrianKrebs #CISA #GitGuardian #GitHubToken #GuillaumeValadon #Sicherheitsbehörde https://sc.tarnkappe.info/c12485 -
CISA Admin Leaked AWS GovCloud Keys on Github
https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
#Cybersecurity&InfrastructureSecurityAgency #PhilippeCaturegli #GuillaumeValadon #ALittleSunshine #LatestWarnings #TheComingStorm #DataBreaches #AWSGovCloud #GitGuardian #Nightwing #Seralys #GitHub
-
CISA Admin Leaked AWS GovCloud Keys on Github
https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
#Cybersecurity&InfrastructureSecurityAgency #PhilippeCaturegli #GuillaumeValadon #ALittleSunshine #LatestWarnings #TheComingStorm #DataBreaches #AWSGovCloud #GitGuardian #Nightwing #Seralys #GitHub
-
CISA Admin Leaked AWS GovCloud Keys on Github
https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
#Cybersecurity&InfrastructureSecurityAgency #PhilippeCaturegli #GuillaumeValadon #ALittleSunshine #LatestWarnings #TheComingStorm #DataBreaches #AWSGovCloud #GitGuardian #Nightwing #Seralys #GitHub
-
CISA Admin Leaked AWS GovCloud Keys on Github
https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
#Cybersecurity&InfrastructureSecurityAgency #PhilippeCaturegli #GuillaumeValadon #ALittleSunshine #LatestWarnings #TheComingStorm #DataBreaches #AWSGovCloud #GitGuardian #Nightwing #Seralys #GitHub
-
CISA Admin Leaked AWS GovCloud Keys on Github
https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
#Cybersecurity&InfrastructureSecurityAgency #PhilippeCaturegli #GuillaumeValadon #ALittleSunshine #LatestWarnings #TheComingStorm #DataBreaches #AWSGovCloud #GitGuardian #Nightwing #Seralys #GitHub
-
I am extremely proud to say that #GitGuardian has raised our Series C funding, validating everything we have been working for over the past few years and setting the stage for an exciting next few years of fighting secrets sprawl.
-
Why boards must prioritize non-human identity governance https://www.helpnetsecurity.com/2026/02/03/gitguardian-boards-nhi-governance/ #identitymanagement #nonhumanidentities #cybersecurity #GitGuardian #Don'tmiss #boardroom #cyberrisk #Hotstuff #opinion #News #CISO
-
Stop what you are doing and watch this amazing talk from someone who I am proud to call a colleague from #GitGuardian.
The level of research Gaëtan does is inspiring -
GhostAction Attack Steals 3,325 Secrets from GitHub Projects – Source:hackread.com https://ciso2ciso.com/ghostaction-attack-steals-3325-secrets-from-github-projects-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttack #GhostAction #GitGuardian #SupplyChain #DockerHub #FastUUID #Hackread #security #GitHub #Python #CI/CD #PyPI
-
GhostAction Attack Steals 3,325 Secrets from GitHub Projects https://hackread.com/ghostaction-attack-steals-github-projects-secrets/ #Cybersecurity #CyberAttack #GhostAction #GitGuardian #SupplyChain #DockerHub #Security #FastUUID #GitHub #Python #CI/CD #PyPI
-
What the GitGuardian secrets sprawl report reveals about leaked credentials https://www.helpnetsecurity.com/2025/09/02/gitguardian-secrets-sprawl-video/ #GitGuardian #Don'tmiss #report #Video #video #News
-
The Nx "s1ngularity" Attack: Inside the Credential Leak
Link
Nx 套件供應鏈攻擊揭露未來資安威脅趨勢與防護挑戰
https://example.com/article/nx-supply-chain-attack-analysis
📌 Summary:
本篇文章深入分析了 Nx 套件發生的供應鏈攻擊案例，揭露攻擊者如何運用多重手法系統性竊取系統中包括 GitHub 令牌、npm 認證金鑰、SSH 私鑰、環境變數 API 金鑰及加密貨幣錢包等敏感憑證。攻擊流程涵蓋掃描常見檔案位置和環境變數，強調攻擊的全面性，並透過雙層 base64 編碼隱匿竊取資料，利用 GitHub 上命名規則為「s1ngularity-repository」的公開儲存庫作為資料外洩管道。攻擊者也植入破壞性負載，修改 shell 啟動檔執行系統關機，另嘗試透過大型語言模型（LLM）客戶端尋找並竊取憑證，因這些 AI CLI 工具通常具備較高權限並存取敏感開發環境。文章指出感染系統中 macOS 佔多數，反映蘋果平臺於開發者社羣的影響力。GitGuardian 對外發布免費工具 S1ngularity Scanner，協助用戶偵測是否受影響。值得注意的是，攻擊所竊取的憑證多半尚未被及時撤銷，反映開發者對於憑證洩漏反應不足。最後文章強調遭竊憑證僅刪除檔案不夠，必須妥善盤點、即時撤銷並自動化操作，纔能有效提升供應鏈攻擊下的整體企業防護能力。
🎯 Key Points:
→ 攻擊手法與目標：
★ 系統掃描包含 GitHub token、npm keys、SSH 金鑰與環境變數 API keys，著重憑證搜刮以助於側移動作。
★ 憑證資料以雙層 base64 編碼躲避偵測，並利用 GitHub 「s1ngularity-repository」儲存庫公開外洩。
★ 植入破壞性程式碼改寫 ~/.bashrc、~/.zshrc，造成新終端機啟動即崩潰。
★ 針對 LLM 工具如 Claude、Gemini、Q 等特定 AI CLI 客戶端蒐集憑證，因這些工具具高權限並關聯敏感環境。
→ 受影響環境與惡意檔案監控：
★ 約 85% 感染系統為 macOS，凸顯針對蘋果平臺開發生態系。
★ 33% 系統安裝有至少一套 LLM 工具，證實攻擊者的策略合乎當前 AI 開發趨勢。
★ 多數 LLM 客戶端對惡意指令不予配合，展現出意外的安全防護效果。
★ GitGuardian 監控發現超過 1,300 個相關公開儲存庫，儘管大多被 GitHub 迅速刪除，仍有超過千條有效且仍未撤銷的憑證洩露。
→ 防護與回應建議：
★ GitGuardian 推出免費工具 S1ngularity Scanner 及 HasMySecretLeaked 服務，方便用戶檢測憑證是否遭外洩。
★ 強調僅刪除暴露文件不夠，必須立刻撤銷憑證並實施全面盤點。
★ 企業必須建置自動化憑證管理及撤銷機制，以降低供應鏈攻擊後憑證被濫用的風險。
★ 供應鏈攻擊已威脅開發者生態系，對安全策略提出挑戰，未來軟體交付必須具備快速偵測、響應及控制能力。
🔖 Keywords:
#Nx套件攻擊 #供應鏈攻擊 #憑證竊取 #大型語言模型 LLM #GitGuardian -
"#DOGE Denizen Marko Elez Leaked API Key for xAI
Marko Elez, a 25-year-old employee at Elon Musk’s Department of Government Efficiency (#DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security."
https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/
-
DOGE Denizen Marko Elez Leaked API Key for xAI
https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/
#VicePresidentJ.D.Vance #TheWallStreetJournal #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
DOGE Denizen Marko Elez Leaked API Key for xAI
https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/
#VicePresidentJ.D.Vance #TheWallStreetJournal #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
DOGE Denizen Marko Elez Leaked API Key for xAI
https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/
#VicePresidentJ.D.Vance #TheWallStreetJournal #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
DOGE Denizen Marko Elez Leaked API Key for xAI
https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/
#VicePresidentJ.D.Vance #TheWallStreetJournal #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
DOGE Denizen Marko Elez Leaked API Key for xAI
https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/
#VicePresidentJ.D.Vance #TheWallStreetJournal #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
DOGE Denizen Marko Elez Leaked API Key for xAI https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/ #TheWallStreetJournal #VicePresidentJDVance #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
DOGE Denizen Marko Elez Leaked API Key for xAI https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/ #TheWallStreetJournal #VicePresidentJDVance #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
DOGE Denizen Marko Elez Leaked API Key for xAI https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/ #TheWallStreetJournal #VicePresidentJDVance #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
DOGE Denizen Marko Elez Leaked API Key for xAI https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/ #TheWallStreetJournal #VicePresidentJDVance #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #BusinessInsider #TheNewYorkTimes #TheComingStorm #PresidentTrump #DataBreaches #GitGuardian #Techcrunch #MarkoElez #Seralys #twitter #GitHub #DOGE #Grok #xAI #X
-
#Security Alert: Massive #Laravel APP_KEY leak exposing 600+ apps to remote code execution 🚨 #GitGuardian & #Synacktiv research reveals 260,000 exposed keys on #GitHub with potential RCE via deserialization attacks #cybersecurity #php #opensource
https://blog.gitguardian.com/exploiting-public-app_key-leaks/
-
GitGuardian Partners with GuidePoint Security to Strengthen Application Security Offerings – Source: securityboulevard.com https://ciso2ciso.com/gitguardian-partners-with-guidepoint-security-to-strengthen-application-security-offerings-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #GitGuardian
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/ #DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/ #DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/ #DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/ #DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs
https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/
#DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs
https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/
#DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs
https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/
#DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs
https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/
#DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs
https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/
#DepartmentofGovernmentEfficiency #GeneralServicesAdministration #PhilippeCaturegli #TheWashingtonPost #ALittleSunshine #LatestWarnings #TheComingStorm #CaroleWinqwist #EricFourrier #GitGuardian #Twitter/X #Reuters #Seralys #GitHub #SpaceX #Tesla #DOGE #Grok #GSAi #xAI
-
Report: The State of Secrets Sprawl 2025 https://www.helpnetsecurity.com/2025/03/19/report-the-state-of-secrets-sprawl-2025/ #Whitepapersandwebinars #GitGuardian #Don'tmiss #report #News
-
Infosec products of the month: December 2024 https://www.helpnetsecurity.com/2024/12/27/infosec-products-of-the-month-december-2024/ #RunSafeSecurity #StamusNetworks #SweetSecurity #VersaNetworks #CatoNetworks #RadiantLogic #GitGuardian #Horizon3ai #SecureAuth #Stairwell #Fortinet #Appdome #Datadog #Netwrix #Tenable #Trellix #News #Veza
-
Infosec products of the month: December 2024 https://www.helpnetsecurity.com/2024/12/27/infosec-products-of-the-month-december-2024/ #RunSafeSecurity #StamusNetworks #SweetSecurity #VersaNetworks #CatoNetworks #RadiantLogic #GitGuardian #Horizon3ai #SecureAuth #Stairwell #Fortinet #Appdome #Datadog #Netwrix #Tenable #Trellix #News #Veza
-
Infosec products of the month: December 2024 https://www.helpnetsecurity.com/2024/12/27/infosec-products-of-the-month-december-2024/ #RunSafeSecurity #StamusNetworks #SweetSecurity #VersaNetworks #CatoNetworks #RadiantLogic #GitGuardian #Horizon3ai #SecureAuth #Stairwell #Fortinet #Appdome #Datadog #Netwrix #Tenable #Trellix #News #Veza
-
What open source means for cybersecurity https://www.helpnetsecurity.com/2024/12/23/open-source-security-2024-reports/ #cybersecurity #LegitSecurity #GitGuardian #opensource #EndorLabs #software #Tidelift #Lineaje #report #survey #News
-
What open source means for cybersecurity https://www.helpnetsecurity.com/2024/12/23/open-source-security-2024-reports/ #cybersecurity #LegitSecurity #GitGuardian #opensource #EndorLabs #software #Tidelift #Lineaje #report #survey #News
-
What open source means for cybersecurity https://www.helpnetsecurity.com/2024/12/23/open-source-security-2024-reports/ #cybersecurity #LegitSecurity #GitGuardian #opensource #EndorLabs #software #Tidelift #Lineaje #report #survey #News
-
AI is becoming the weapon of choice for cybercriminals https://www.helpnetsecurity.com/2024/12/20/ai-technologies-challenges-2024/ #artificialintelligence #CloudSecurityAlliance #cybersecurity #LegitSecurity #DeepInstinct #GenerativeAI #Bitdefender #GitGuardian #GoogleCloud #AuditBoard #1Password #Bugcrowd #CyberArk #Deloitte #Netskope #Netacea #Code42 #Immuta #Ivanti #Lakera #report #survey #Venafi #Cisco #News #RWS
-
AI is becoming the weapon of choice for cybercriminals https://www.helpnetsecurity.com/2024/12/20/ai-technologies-challenges-2024/ #artificialintelligence #CloudSecurityAlliance #cybersecurity #LegitSecurity #DeepInstinct #GenerativeAI #Bitdefender #GitGuardian #GoogleCloud #AuditBoard #1Password #Bugcrowd #CyberArk #Deloitte #Netskope #Netacea #Code42 #Immuta #Ivanti #Lakera #report #survey #Venafi #Cisco #News #RWS
-
AI is becoming the weapon of choice for cybercriminals https://www.helpnetsecurity.com/2024/12/20/ai-technologies-challenges-2024/ #artificialintelligence #CloudSecurityAlliance #cybersecurity #LegitSecurity #DeepInstinct #GenerativeAI #Bitdefender #GitGuardian #GoogleCloud #AuditBoard #1Password #Bugcrowd #CyberArk #Deloitte #Netskope #Netacea #Code42 #Immuta #Ivanti #Lakera #report #survey #Venafi #Cisco #News #RWS
-
New infosec products of the week: December 20, 2024 https://www.helpnetsecurity.com/2024/12/20/new-infosec-products-of-the-week-december-20-2024/ #RunSafeSecurity #GitGuardian #Stairwell #Appdome #Netwrix #News
-
New infosec products of the week: December 20, 2024 https://www.helpnetsecurity.com/2024/12/20/new-infosec-products-of-the-week-december-20-2024/ #RunSafeSecurity #GitGuardian #Stairwell #Appdome #Netwrix #News