Skip to content

Ward opens soon: join the waitlist and we'll email you the day we open.

What Ward checks

Area: Reputation and impersonation

Credentials in public code

Searches public GitHub code for your domain next to passwords, API keys or connection strings. The secret is never stored.

What it can report

Open each one to see what it means and how to fix it.

Possible secret in public code

What it means

A public GitHub repository (usuario/proyecto) has a file that mentions example.com next to what looks like a credential. GitHub is a site where programmers share code, and anyone can read public repositories. The value isn't stored in Ward, and it's shown masked.

What could happen

A valid password or key in public code lets whoever finds it use the service it protects as if they were you. Bots crawl GitHub non-stop looking for these, so it may have been found already. Deleting the file doesn't remove it from the history, which is why it is urgent.

How an attacker would use it

A programmer publishes a project with a database password in a settings file. Within hours, an automated program finds it, signs in to the database with it and copies the data, without anyone at your company being involved.

How to fix it

  1. Change that credential now: create a new one in the service it belongs to and cancel the old one.Deleting the file isn't enough, because it stays in the repository's history.
  2. Check the service's activity logs for use you don't recognize since the date it was published.
  3. Ask whoever published it to remove it or make the repository private, and to clean its history.
  4. From now on, keep keys and passwords in environment settings or a secrets manager, never in the code.
  5. If it was a database or cloud key, ask your IT person to review what it could access.

How to check it's fixed

Ward searches the public code again. The finding clears when the file no longer shows the secret. Mark the finding as “Pending verification” and Ward will check it again within a minute or two. Once the problem is gone, it moves to “Resolved” on its own.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.