Bulletproof Shoes: Protecting from Accidental Token Leaks

No ratings

Presented at AppSecDayAustralia 2019 by

Max Feldman

Version control software has come a long way, and the barrier to creating an open source project has been lowered to a point of being negligible. However, this has also increased the instances of accidental leakage of credentials or sensitive data into public repositories. Numerous tools now exist which trawl repositories for such information and abuse it almost instantly. For platform developers time is of the essence. We will talk about the history and evolution of our “token nuker” - the automation we use to find and disable exposed Slack tokens in the wild, before they can be abused. We will cover general tactics for preventing developers from shooting themselves in the foot (or mitigating damage if they do).