Hi — while doing some public-good scanning for exposed secrets in public repos, I think I spotted a live-looking OpenSSH private key in private.pem (commit 1082ddc).
I haven't accessed, tested, or used it, and I'm not going to.
What I'd suggest:
- Rotate/revoke this credential with the provider immediately
- Remove it from git history (not just the latest commit — it's still in the log): how to remove sensitive data from a repository
- Move secrets to environment variables or a
.gitignored file going forward
No action needed from me — feel free to close this issue once handled.
Flagged by PublicGuard, an open, non-commercial scan run as part of my security tooling work (companion to SessionGuard). Happy to answer questions, no strings attached.
Hi — while doing some public-good scanning for exposed secrets in public repos, I think I spotted a live-looking OpenSSH private key in
private.pem(commit1082ddc).I haven't accessed, tested, or used it, and I'm not going to.
What I'd suggest:
.gitignoredfile going forwardNo action needed from me — feel free to close this issue once handled.
Flagged by PublicGuard, an open, non-commercial scan run as part of my security tooling work (companion to SessionGuard). Happy to answer questions, no strings attached.