PHANTOM SECRETS: UNDETECTED SECRETS EXPOSE MAJOR CORPORATIONS

Summary from the TLDR InfoSec newsletter

The AquaSec team scanned over 50k repositories belonging to the top 100 organizations on GitHub for secrets using conventional (git clone) and unconventional methods. Using git clone --mirror fetches a more complete git history that includes PRs and other dangling refs. It led to finding additional secrets on 18% of scanned repositories. The Aqua team also tested a novel approach to scanning cached views from SCMs and found that some additional secrets could be found, though the process is difficult and has a lower chance of success.