Hacker News new | ask | show | jobs
by f0e4c2f7 1631 days ago
There are bots that scan GitHub for credentials and private keys.

Sorry that happened to you, I hope it wasn't a lot of money.

Considered adding files like that to .gitignore in the future.

3 comments

But they shouldn't have access to private repos, right?
I deliberately leave various types of cryptocurrency in 'private' areas of quite a lot of online services, including GitHub.

So far, nothing has been taken from GitHub.

(It's part of research for my side project serverthiefbait.com)

Cool project. If I pay you $900 how much of that goes into cryptocurrency?

Seems like you could achieve the same result if you just let your customers buy their own coins and provide an address for you to watch?

about $90-$150 initially, but usually within a few weeks the balance will be upped to $400 or so.

I have had troubles with people using the service as a way to get money off stolen credit cards, so the low initial deposit is a way to avoid that.

There is also a lot of per-customer randomness to prevent bad guys writing logic to detect which wallets are provided by my services. That's why they don't all have a fixed balance.

> Seems like you could achieve the same result if you just let your customers buy their own coins and provide an address for you to watch?

Yes - there are other services that do that for free already. This is more of an all-in-one setup for those who want to set-and-forget.

Really like this project.
Actually already added to .gitignore file but then realized that .js files are not being discarded by .gitignore
If this is a Node.js program you should store private variables in a .env file (with .env added to your .gitignore) then call process.env.[variable name here] to get the key at runtime.

Look up documentation and examples on .env files.

If you deploy to a service such as Vercel or AWS you can set environment variables there for production.

They are if the gitignore matches the file, just like any other filetype.
When I used to work in Crypto we had git hooks set up to prevent this from happening. It takes a bit more time to set up than just adding something to .gitignore but is a more robust solution of you design your hook well.