CuraSec

tag: Secret-Scanning · 2 items

Act archived 543,000 valid credentials still exposed in public GitHub repos
2026-10-01 · BleepingComputer · source ↗ #credentials-exposure#github-secrets#secret-scanning
  • Engineer — Act: Exposed valid credentials are an immediate risk whether or not your org is named — scan all org-owned public (and private) GitHub repos for secrets now using truffleHog or GitHub secret scanning, rotate any discovered credentials, and enable GitHub push protection to block future leaks.
  • SOC/IR — Plan: No specific IOCs are published, but the scale of valid exposed credentials raises likelihood of credential-stuffing and unauthorized API use; build or tune detections for anomalous service-account logins and impossible-travel alerts tied to CI/CD or cloud API keys.
  • Leader — Plan: Direct engineering to run a full secrets audit across org repositories this quarter, verify GitHub push-protection and secret-scanning policies are enforced, and add credential-leakage exposure to the risk register as a developer-practice control gap.
Learn archived Secret Scanner Agent: LLM multi-agent secret + access-context extraction
2026-07-13 · arXiv cs.CR · source ↗ #secret-scanning#incident-response#llm-tooling
  • Engineer — Learn: Novel research on using multi-agent LLMs to extract both credentials and the resources they unlock from unstructured documents — worth tracking as a potential complement to regex-based secret scanners in IR workflows, but no production-ready tool to adopt today.
  • SOC/IR — Learn: The concept of automatically surfacing both a leaked credential and its ‘door’ (target account, cloud resource, endpoint) from emails, tickets, and chat threads maps well to IR triage gaps; worth monitoring for usable tooling derived from this research.
  • Leader — Skip