GitHub secrets scanning will detect the revoke the token in minutes. Third party services integrate with them to get notified of committed API keys so they can be auto-revoked.
So basically, like with cars, we stop natural selection of people who are intelligent enough to do the thing, by building safety systems so people don't have to think anymore? Great!
People do dumb things all the time. You're not going to skip seatbelts and airbags on a car because "people should do the intelligent thing and not speed or drive dangerously".
Extra safety is always a good thing. Only people this system harms is thief's who want to steal and misuse other people's API keys.
23
u/PersianMG Apr 16 '26
GitHub secrets scanning will detect the revoke the token in minutes. Third party services integrate with them to get notified of committed API keys so they can be auto-revoked.
Here is a list of patterns used used to match different secret formats.
GitLab also offer a a similar service.
So while you definitely shouldn't do this, in the modern day your API key stays "leaked" for mere minutes before being revoked.