GitHub Now Blocks Two More Anthropic Key Types at Push. Here’s What It Still Misses

说明与用途

GitHub 现在在推送时阻止两种新的 Anthropic 密钥类型，但未启用保护的私有仓库仍然易受攻击。建议的措施：启用推送保护，为代理使用服务密钥，并将 .env 从仓库中移除。

问题

Anthropic API keys can be accidentally committed to Git repositories, exposing them to public or private repositories and risking unauthorized access.

结果

By enabling push protection, using dedicated service account keys for agents, and removing .env files from the repository, developers can prevent accidental exposure of Anthropic keys and maintain secure workflows.

工作流

• 1. Enable repository push protection where possible. 2. Assign separate Anthropic service account keys to agents and CI. 3. Add ".env" to .gitignore, remove it from the index with git rm --cached .env, and audit history for Anthropic keys using git log --all -p | grep -c 'sk-ant-'.
• 4. If a real key is found, rotate it in the Claude Console before rewriting history.

证据

GitHub now detects two new Anthropic secret types, anthropic_user_api_key and anthropic_service_api_key, and that push protection blocks both by default.

来源

A block is not a wall. The same docs say that by default "anyone with write access to the repository can bypass push protection by specifying a bypass reason."

来源

git rm --cached .env fails harmlessly if .env was never tracked. The count includes placeholders and removed lines, so look at the matches before you act.

来源