If you’ve got that much money in a project, it’s not a prototype.
How does the monetary value matters? A prototype is a prototype, a quick project to test some concept. If you wanna test some concept around large transfers, does that mean it's suddenly not a prototype?
This repo should have had all types of static analysis running automatically.
Would that actually prevent this issue? So lets say they make the repository public, the static analysis tool begins screaming at the repo owner. Now, he has 2 minutes to transfer those funds somewhere (manually), before the thief automatically makes that transfer for them, to their own wallets.
Sounds like the guy just needed a hardware wallet instead of whatever they were doing. Who stores unencrypted wallet details containing $40K on disk?! Committed to git?!
Comments
If you’ve got that much money in a project, it’s not a prototype.
This repo should have had all types of static analysis running automatically.
Hell, GitHub has built in secret scanning. Apparently it was only set as the default for all new repos in March 2024[].
[] https://docs.github.com/en/code-security/secret-scanning/con...
How does the monetary value matters? A prototype is a prototype, a quick project to test some concept. If you wanna test some concept around large transfers, does that mean it's suddenly not a prototype?
Would that actually prevent this issue? So lets say they make the repository public, the static analysis tool begins screaming at the repo owner. Now, he has 2 minutes to transfer those funds somewhere (manually), before the thief automatically makes that transfer for them, to their own wallets.
Sounds like the guy just needed a hardware wallet instead of whatever they were doing. Who stores unencrypted wallet details containing $40K on disk?! Committed to git?!
The platform could scan the commit and hide it before it gets displayed publicly.
Totally agree wallets with any real amount of money should probably not be on disk
if you could make static analysis fast enough, GitHub could it make it so that the git push itself is refused, so no one ever sees it.
Of course, an escape hatch (like adding some "I know what I am doing" tag to the commit) would be necessary but that's trivial to setup.