WHAT'S THE WORST PLACE TO LEAVE YOUR SECRETS?

Summary from the TLDR InfoSec newsletter

A researcher deployed canary tokens to a variety of different locations to measure how quickly attackers would find them and attempt to use them on AWS. Tokens deployed to package managers (npm and PyPi) and GitHub were accessed within minutes whereas Pastebin, a web server, and a Docker container took longer. Tokens deployed to GitLab, BitBucket, S3, GCP Cloud Storage, and a (weak) password-protected Pastebin were never accessed, suggesting that attackers are not actively monitoring these resources.