World 8: Shields: Security

Secret scanning and push protection

You will learn: how GitHub catches leaked keys, before and after a push.

The problem

~/diary $ git diffdiff --git a/app.js b/app.jsindex f9e5b50..85fdc47 100644--- a/app.js+++ b/app.js@@ -1,3 +1,3 @@ // Weather widget-const key = process.env.API_KEY;+const key = "fake_demo_key_123"; showWeather("Ipoh", key);

In a rush, you pasted the key straight into app.js. You’re about to push. Will anyone notice in time?

Watch

GitHub has a guard called . It reads your repo, old commits too, looking for keys. Found one? It raises an alert, so you can act. Public repos get it for free.

Try it

Be the scanner! Tap every line that holds a secret.

Tap every line that holds a secret.

0 of 2 found

Watch

checks your push before it lands. Spots a key? GitHub blocks the push and shows where the key is. The secret never reaches the repo.

Try it

Put a blocked push in order. First step at the top.

First step at the top. Put these in order. Use the arrows, or drag.

GitHub spots the key
You push your commits
You push again, safely
You take the key out of your commits
The push is blocked

Predict

Push protection blocked you. The key is real. What is the best move?

Check

Which guard does it? Sort each card.

Drag a card into a box. Or tap the card, then tap the box.

You did it!

You can now let GitHub’s guards catch leaked keys for you.

Go deeper (optional)

Some services team up with GitHub. If their key leaks in a public repo, GitHub tells them. They can cancel the key fast. Your own pushes to public repos get push protection by default. Tools like gitleaks can even check before you commit.