Sharon Brizinov scanned all of GitHub’s “Oops Commits” for leaked secrets: zero-commit force pushes that developers use to make a bad commit disappear from a branch.
GH Archive records these events and GitHub keeps the dangling commits retrievable by their hash, so he fetched the “before” commit of every such push since 2020 and ran TruffleHog over it.
DevClass reports that the haul earned around $25k in bug bounties and included a token with admin access to all Istio repositories, with committed .env files behind just over half of the leaks.
Truffle Security followed up with the open-source Force Push Scanner and estimates that the roughly 15 million zero-commit force pushes leave tens of millions of dangling commits accessible.
Even a quickly corrected mistake stays in version control history, so a committed secret has to be revoked, not just force-pushed away.
Leaked Secrets in Hidden Commits
··1 min