HOW I SCANNED ALL OF GITHUB'S “OOPS COMMITS” FOR LEAKED SECRETS

Summary from the TLDR Web Dev newsletter

A white-hat hacker found leaked secrets in deleted GitHub commits by scanning force push events using the GitHub Event API and GH Archive. He developed a tool to identify these "Oops Commits" and discovered thousands of active secrets, including one that could have led to a massive supply-chain compromise in the Istio project. The process involved manual searching, a vibe-coded triage tool, and an eventual AI-driven approach to identify valuable secrets.