⬇ Download holy card: ·
Blessed NotGitBleed, Who Signed Commits With a Password
Patron of Git metadata, dialogs that look like a login but aren't, and people whose surname is hunter2.
Life
In April 2022 Aaron Devaney of MDSec, with Will Deane, went public with NotGitBleed: thousands of developers had typed their GitHub username and password into the author and email fields of their commits, often fooled by an IDE prompt that looked like a sign-in screen. The researchers estimated between 50,000 and 100,000 credentials exposed in repository histories. No bleeding, as the name says: just a form filled in with too much trust.
Prayer
O Blessed NotGitBleed, who writes the password where the email belongs, let our tools look for the @ before they save. Amen.
How to celebrate
Celebrated by checking your git config, rotating reused passwords, and praising GitHub, which now revokes tokens it finds in commit metadata.
What you sign stays written.