Yes, i did it. What amaze me is that bots are scanning github for searching free api keys. And i can understand that, but what is weird. They were able to activate different api (compute engine) host 3 virutal machines and use it to mine crypto. A question is, isn't it vulnerabilty that they can host virtual machines and use different api ? I had to shut down whole project.
2 Answers
Depending on the role assigned to compromised service-account - attacker can do everything or nothing.
There are some basic "best practices" regarding keys and service accounts that should be usefull to you.
Generally use (if possible) different service account to manage VM's or/and rotate keys weekly or twice a week (just like the Google-managed ones) and avoid putting any API keys into repositories that can/will be synchronised with public ones :)
Yes - sounds silly but slip-up's happen and this will make unathorised access way less likely or impossible.
Also fallowing "least privilege" rule may be worth going for - compromised credentials will not be much usefull then.
Note that, since Aug. 2021:
Secret scanning org-level REST API
GitHub Advanced Security customers can now retrieve private repository secret scanning results at the organization level via the GitHub REST API.
This new endpoint, in beta, supplements the existing repository-level endpoint.
The API is: GET /organizations/:organization_id/secret-scanning/alerts.
See "About secret scanning for private repositories"
In your case, querying that new (still beta) API endpoint can be a good practice, to be alerted before an attacker has time to do much damage.
Related