Hacker News

points by dorianmariecom 1 day ago | 0 comments

same on github or gitlab etc

They compare this in the article:

  Platform  | Repos scanned | Verified-live credentials | Per 1K repos
  ----------+---------------+---------------------------+-------------
  Bitbucket |    ~2,600,000 |                     6,212 |         2.39
  GitLab    |    ~5,600,000 |                    17,430 |         3.11
  Gitee     |     7,256,531 |                    26,400 |         3.64

[–] LoganDark 1 day ago

I wonder if this is because of providers scanning those platforms more than they scan Gitee, or the platforms themselves notifying the providers. Fairly sure that GitHub, for example, supports spotting certain live credentials on push and immediately notifying the platform to revoke it. And plenty of providers also watch the open web for live tokens and revoke them immediately.

[–] owlninja 1 day ago

From the article

> It has no public equivalent of the platform-vendor secret-scanning partnerships that have become standard on GitHub.