GitHub Now Blocks Two More Anthropic Key Types at Push. Here’s What It Still Misses

Описание и применение

GitHub теперь блокирует два новых типа ключей Anthropic при push, но приватные репозитории без включённой защиты остаются уязвимыми. Рекомендуется включить push‑защиту, использовать сервисные ключи для агентов и удалять .env из репозитория.

Задача

Anthropic API keys can be accidentally committed to Git repositories, exposing them to public or private repositories and risking unauthorized access.

Результат

By enabling push protection, using dedicated service account keys for agents, and removing .env files from the repository, developers can prevent accidental exposure of Anthropic keys and maintain secure workflows.

Рабочий процесс

• 1. Enable repository push protection where possible. 2. Assign separate Anthropic service account keys to agents and CI. 3. Add ".env" to .gitignore, remove it from the index with git rm --cached .env, and audit history for Anthropic keys using git log --all -p | grep -c 'sk-ant-'.
• 4. If a real key is found, rotate it in the Claude Console before rewriting history.

Доказательства

GitHub now detects two new Anthropic secret types, anthropic_user_api_key and anthropic_service_api_key, and that push protection blocks both by default.

Источник

A block is not a wall. The same docs say that by default "anyone with write access to the repository can bypass push protection by specifying a bypass reason."

Источник

git rm --cached .env fails harmlessly if .env was never tracked. The count includes placeholders and removed lines, so look at the matches before you act.

Источник