Don’t leave sensitive things on Github thinking that no one is going to read your code

The other day I was developing a feature for LeetLinked, my Google/Bing scraping tool for Employee LinkedIn profiles and I found myself needing API access to HaveIBeenPwned.

Unfortunately, it was likely heavily abused and locked behind a paywall, which makes total sense. No shade to Troy Hunt for doing so. I was ready to pay the $4 a month for API access. My first instinct was “Oh, I’ll just stick it on my credit card and pay it later” as I’m sure most of you do. It turns out that didn’t work so well. My card vendor wasn’t approved. Alright, no proble, let me try my debit card instead. Declined.

What now? I want to integrate HaveIBeenPwned into my tool to more effectively search for valid email addresses and employees that were involved in Databreaches. What am I to do?

Never. Ever. Leave your API keys on Github. Someone like me will find them.

So after both of my payment methods failed, I took a look at the documentation and noticed that the API key was verified by a header hibp-api-key.

b410b2a551a00f63936f49cba47ef566.png Have I Been Pwned API Documentation

I knew exactly what to look for – scripts that referenced hibp-api-key on Github.

b322e74bb54c94a4416411fd32d0c84a.png hibp-api-key on Github

One Hundred and Seventy-Five results with hibp-api-key mentioned. Oh boy, are there some API Keys here.

a94894c44aa55d49b152a21e53abe477.png

Information redacted to protect the identity of the user. All users have been contacted with recomendations to remove the API key from their code.

0fe9edd81b053a2adb7fc109cc449117.png

And the API Key is valid.

a954bdface87ee8c70ec5effc01780c2.png

And another!

In total I found approximately 6 valid API keys, thats a huge yikes. There were a few other API keys that I had found like MailHunter, Virus Total, etc. while searching for HIBP-API-Keys.

In conclusion: Don’t leave your API keys on Github. It’s a bad idea. People will use them. You may think that your code isn’t special and that no one is going to see it, unfortunately, you’re wrong. I will see it. Always ask yourself before uploading something - Is this information sensitive? Can I easily get it removed? If the answer to either of those is yes, don’t post it. You will regret it!