GitHub Now Scans for WeChat Secrets as a Tencent Partner

GitHub now scans public and private repositories for WeChat keys and tokens — including those for WeChat Official Accounts, Mini Programs, and WeChat Pay — and forwards them to Tencent. You’ll get a key leak notification on Tencent’s side.

What a Secret Leak Is

When integrating third-party APIs we need keys to prove our identity. An engineer finishes testing and commits the code, often carelessly committing the key along with it. Once other developers pull the repo, your secret is out.

This mistake — committing secrets along with code — is genuinely, genuinely common. I’ve seen secrets sitting in code in my own repos, in colleagues’ repos, and in libraries I use.

The GitHub Secret Scanning Partner Program

GitHub runs a secret scanning partner program: it scans repositories for known secret formats and reports them to its partners. Commit an Alibaba Cloud account key to GitHub, for instance, and Alibaba Cloud receives a notification from GitHub, then prompts you in its management console that your key may have leaked.

If you’re a vendor and want to join, see: https://docs.github.com/en/developers/overview/secret-scanning-partner-program

The current vendor list includes Alibaba Cloud, Tencent Cloud, JD Cloud, AWS, Azure, Google Cloud, and now, newly, Tencent WeChat.

Secret scanning is enabled by default on all public repositories.

To configure secret scanning for a repository:

1. On the repository’s main page, click “Settings” under the repository name.
2. In the “Security” section of the sidebar, click “Code security and analysis”.
3. If Advanced Security isn’t enabled yet, click “Enable” next to “GitHub Advanced Security”.
4. Review the impact of enabling Advanced Security, then click “Enable GitHub Advanced Security for this repository”.
5. When you enable Advanced Security, secret scanning may be enabled automatically depending on the organization’s settings. If “Secret scanning” shows an “Enable” button, click it to turn secret scanning on. If you see a “Disable” button, secret scanning is already enabled.

GitHub and Tencent WeChat

GitHub forwards secrets found in repositories to Tencent WeChat, which notifies affected users with a warning. Tencent WeChat’s docs: https://pay.weixin.qq.com/docs/merchant/development/key-leak-mitigation-guide.html; GitHub’s blog post: https://github.blog/changelog/2022-12-19-tencent-wechat-is-now-a-github-secret-scanning-partner/

Secret Scanning on JH GitLab

JH GitLab supports secret scanning too. JH GitLab 14.5 updated its secret detection scanner to recognize 47 new “identifiable” secret patterns, bringing detection coverage to over 90 patterns.

To enable it you need GitLab Runner capability to run pipelines. Add this at the bottom of your .gitlab.ci.yml:

include:
   - template: Jobs/Secret-Detection.gitlab-ci.yml

JH GitLab then scans for secrets whenever pipelines run. To learn more, see: https://docs.gitlab.com/ee/user/application_security/secret_detection/#supported-secrets

What to Do After a Leak

First, revoke the secret immediately and apply for a new one. Then you can remove it from history entirely.

Purging Files From Repository History

Warning: nothing can fully purge it. The secret may already exist in databases, other branches, clones people made, and forks. Once committed, treat it as leaked.

If you commit sensitive data — passwords or SSH keys, say — to a Git repository, you can remove it from history. To thoroughly delete unwanted files from history, use git filter-repo.

Removing Sensitive Data From the Repository

1. First download and install git-filter-repo.
2. Then clone the repository fresh and cd into it.
3. Run git filter-repo --invert-paths --path <leaked file path>
4. Add the file containing sensitive data to .gitignore so it can’t be committed again by accident.
5. Run git push origin --force --all to force-push your local changes, overwriting the remote repository and every branch you’ve pushed. A force push is required to remove sensitive data from commit history.