The real question.
Are people watching private repos go public? Or are people watching for exposed credentials?
Like if I make a Snake game in Python, then make it randomly go public, would anyone notice or care?
this post was submitted on 13 Jun 2026
48 points (83.3% liked)
Programming
27246 readers
211 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 3 years ago
MODERATORS
Info for anyone reading, while the read was quite interesting, the whole article turned out to be an ad.
Ovaltine? A crummy commercial? Son of a bitch!
From the post description this made it obvious it's an ad for something. Otherwise it sounded like someone actually made reasearch on the subject.
This came out of building a monitor for exactly these repo-setting changes.
There's hardly any cost to a bot operator, malicious , opportunistic or legitimate, to hit your end-point, so once they found a reason to hit it, hitting it a million more times costs cents.
Operators like Meta seem to make it a sport, trying to hit you with multiple parallel requests from multiple sources, across both IPv4 and IPv6 simultaneously, resulting in an effective DDoS for small and medium end point owners and increasing costs significantly for anyone trying fruitlessly to stay ahead of their onslaught.
The malicious traffic by contrast, attempts to sneak in a request with dynamic rate throttling as part of their attempts to stay hidden.
Between these two extremes are the opportunistic operators who hit the same 404 endpoint day after day, hour after hour, minute by minute, for weeks with specific blocks the only remedy.
There are plenty of legitimate bots that quietly go about their business, hitting you every couple of seconds, leaving you alone for long stretches, incrementally crawling, honouring the robots.txt file and generally acting the way a considerate adult might. They've been getting lower and lower in numbers over the years.
Source: I have logs.
It’s really not surprising that it’s so fast, since you can easily get newly created repos and repos made public from a github API (the “list public events” one at /events). Makes sense that people are polling this and feeding it to TruffleHog.
I guess the rather consistent 6 minutes don't come from it actually taking so long but rather from some kind of caching that only makes these repos show up after 5 minutes plus 1 minute for fetching and using the api key.
There are criminal but professsional groups with million-$ budgets out there.
Hell, there are nation states that have been doing this sort of thing for decades. 15 or so years ago I worked in IT at a university. They bought some servers from IBM and had IBM install them on public IP addresses. It is extremely well known that IBM regularly uses default passwords (or at least used to) like “PASSW0RD” with a zero for the O. I had access to one of these servers about 15 minutes after it was set up, and the first thing I did after changing the password was to check the logs. Sure enough an IP address from China had already logged in as root. I immediately wiped the entire server clean and reinstalled everything.