materialsproject/maggma

Scan for API keys on PR

Opened this issue · 3 comments

Andrew-S-Rosen commented

I saw some terrifying Twitter threads about people accidentally uploading credentials to their GitHub repo and it causing massive security/financial havoc.

Might it be worth adding https://github.com/marketplace/gitguardian to maggma since this is one of the packages where that might be done accidentally? I added it to my repos, and it took all of about 30 seconds to setup (you just hit install). It's free.

rkingsbury commented

Sounds like a good idea to me! It looks like it has to be activated by a GitHub org admin (which I am not). What do you think @munrojm? If you agree, can you enable?

  • 👍1
Andrew-S-Rosen commented

Here's the Twitter thread btw if you're morbidly curious: https://twitter.com/georgemporter/status/1677378445658173442

munrojm commented

Looking at it closer, it might make sense to add it to the org instead of through my personal account as it has to go through github billing despite it being free for public repos.

  • 👍1