Session Title: Securing API tokensAbstract:Developers know we're supposed to obfuscate tokens using a secret store, but sometimes we forget and keys areleft in git commit history. API keys are accidentally leaked on GitHub.com thousands of times per day, which leads tofraudulent misuse of cloud services and account takeovers. API token leaks are the #1 source of data breaches^1.In this talk we'll share how we're preventing API token leaks on GitHub.com, best practices for API key generation,and share ways you can secure API keys you mint.1) Verizon data breach investigations report 2022---Additional Description:Agenda:- API token leaks, how they happen and why they are a problem- How big is this problem - Share data from Github.com- What are the usual strategies for preventing leaks - secret stores are good, but policy alone does not prevent leaks.- What are best practices for generating token types - use prefixes & checksums in addition to entropy and find usingstatic analysis techniques. Share some open source/free tools for identifying tokens in source using regex patterns.- Talk about industry efforts to improve downstream token identification and how you can participate if you are aservice provider or other platform/tool that mints API tokens.