Loading…
5
A pen tester in Dallas asked me one thing about my API keys and it flipped how I build everything
I was showing off my little side project to a guy I met at a meetup downtown. Felt good about it. Then he asked where my keys live. I said hardcoded in the config, same as always, it's a private repo. He just nodded and said that's how most leaks start.
I didn't get it at first. Then he walked me through it. Keys in code end up in git history even if you delete them later. One bad merge, one fork, one old laptop and they're out. He said a single exposed key on a public repo can get scraped and abused within minutes, sometimes seconds.
So I changed it. Now everything goes through env vars and a secret manager, nothing in the repo at all. I also set up key rotation and short expiry windows. Took me a weekend to redo but it was worth it.
The part that stuck with me was how casual I had been about it. I thought private repo meant safe. It doesn't.
Curious what you all do for key rotation, do you automate it or just do it by hand on a schedule?
1 comments
Log in to join the discussion
Log In1 Comment
ryan_ellis7d ago
Dude, "within minutes, sometimes seconds"? That part hit me like a brick. I always figured scrapers were out there hunting for keys but I pictured it taking days or weeks for someone to actually find and use one, not seconds. Wild to think some bot is just sitting there pulling every commit from public repos the second it goes up. Makes me want to go check my old repos right now because I know for a fact I had a Stripe key sitting in a config file like two years ago that I "deleted" later. The git history thing is what gets me, thats the part nobody tells you when you're starting out.
2