This was already noted in #688, but I forgot to do it in #2511. Bearer tokens should be easy to recognize so that machines can detect them and thus be able to prevent or remediate leaks. Liberapay should probably start using the generic RFC 8959 prefix secret-token: followed by the brand prefix lp_. To avoid breaking existing sessions, the new prefix should only be required for newly generated secrets. To avoid wasting space, the secrets should continue to be stored without the prefix in the database.
It looks like GitHub's secret scanning partner program isn't open source, so Liberapay probably shouldn't join it. The list of patterns should be a common that everyone can use, contribute to and fork, not a private database belonging to Microsoft.
This was already noted in #688, but I forgot to do it in #2511. Bearer tokens should be easy to recognize so that machines can detect them and thus be able to prevent or remediate leaks. Liberapay should probably start using the generic RFC 8959 prefix
secret-token:followed by the brand prefixlp_. To avoid breaking existing sessions, the new prefix should only be required for newly generated secrets. To avoid wasting space, the secrets should continue to be stored without the prefix in the database.It looks like GitHub's secret scanning partner program isn't open source, so Liberapay probably shouldn't join it. The list of patterns should be a common that everyone can use, contribute to and fork, not a private database belonging to Microsoft.