1

Some time ago a developer in my team accidentally published some code to his GitHub repository containing ENV_VARS that belonged to our company's SendGrid account. Fortunately I noticed this as soon as he created the repository and it was deleted.

Around 12 hours after this happened, SendGrid locked the company account and mentioned this was done because they found account details in a GitHub repository (the one my developer previously published and subsequently deleted).

This got me thinking: would the "bot" that SendGrid uses be searching GitHub with the username/password (in plain text)? If so, then this is a big security issue on their side, right (storing passwords in plain text)?

Even if they were encrypting the password and decrypting the password to search GitHub for exposed credentials, this would still seem unsafe as the password would be exposed to GitHub via a search string parameter.

Here is an example of what the ENV_VARS for the SendGrid account look like:

MAIL_DRIVER=smtp
MAIL_HOST=smtp.sendgrid.net
MAIL_PORT=587
MAIL_USERNAME=username
MAIL_PASSWORD=null
MAIL_ENCRYPTION=tls
Improve this question

2 Answers 2

Reset to default
3

SendGrid is likely proactively using a service such as GitGuardian: https://www.gitguardian.com/

GitGuardian doesn't look for specific credential strings, it looks for telltale signs such as known API key prefixes, standardized variable assignments, etc.

Improve this answer
1
  • Haven't heard of that service before. Looks very interesting.
    – Enijar
    Commented Apr 11, 2019 at 15:47
1

They wouldn't need to compare the strings against each other. All they'd need to do is run the login function with that username/password pair. If it gets a hit, bingo, you've got a compromised account.

Improve this answer
1
  • How would they know which strings are the usernames and which are the passwords?
    – Enijar
    Commented Apr 11, 2019 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .