{"id":45288,"date":"2022-02-14T17:24:31","date_gmt":"2022-02-14T17:24:31","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33107\/GitBleed-Finding-Secrets-In-Mirrored-Git-Repositories.html"},"modified":"2022-02-14T17:24:31","modified_gmt":"2022-02-14T17:24:31","slug":"gitbleed-finding-secrets-in-mirrored-git-repositories","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/","title":{"rendered":"GitBleed &#8211; Finding Secrets In Mirrored Git Repositories"},"content":{"rendered":"<h2 id=\"summary\">Summary<\/h2>\n<p class=\"has-text-align-justify\">Due to a discrepancy in Git behavior, partial parts of a source code repository are visible when making copies via the <a href=\"https:\/\/git-scm.com\/docs\/git-clone\">\u201cgit clone\u201d<\/a> command. There are additional parts of the repository that only become visible when using the \u201c\u2013mirror\u201d option. This can lead to secrets being exposed via git repositories when not removed properly, and a false sense of security when repositories are scanned for secrets against a cloned, non-mirrored copy.<\/p>\n<p>Attackers and bug bounty hunters can use this discrepancy in Git behavior to find hidden secrets and other sensitive data in public repositories.<\/p>\n<p>Organizations can mitigate this by analyzing a fuller copy of their repositories using the \u201c\u2013mirror\u201d option and remove sensitive data using tools like <a href=\"https:\/\/rtyley.github.io\/bfg-repo-cleaner\/\">BFG<\/a> or <a href=\"https:\/\/github.com\/newren\/git-filter-repo\">git-filter-repo<\/a> (which do a more thorough job).<\/p>\n<h2 id=\"technical-details\">Technical Details<\/h2>\n<p>Git is a popular open source tool used for version control of source code. When users make a copy of a local or remote git repository, they use the <a href=\"https:\/\/git-scm.com\/docs\/git-clone\">\u201cgit clone\u201d<\/a> command. However, this command doesn\u2019t copy all of the data in the originating repository such as deleted branches and commits. On the other hand, there is a \u201c\u2013mirror\u201d option which copies more parts of the repository. The discrepancy between the two behaviors can lead to secrets and other sensitive data lingering in the original repository. Additionally, existing tools for secrets detection often operate on cloned repositories and do not detect secrets in the mirror portion of the repository unless cloned via the \u201c\u2013mirror\u201d command.<\/p>\n<p>We also tested forking in GitHub and GitLab, and in both systems forking uses the regular \u201cgit clone\u201d behind the scenes and not the \u201c\u2013mirror\u201d version. That means that repositories containing secrets in the mirrored portion will not propagate those secrets to their forks.<\/p>\n<p>We provide two examples of repositories containing hidden secrets that are only visible when cloning with the \u201c\u2013mirror\u201d option. These can be found here:<\/p>\n<p>If you try to clone the repository without the \u201c\u2013mirror\u201d option, and retrieve the secret, it will not work:<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" data-attachment-id=\"5898\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/delete_clone\/\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png\" data-orig-size=\"605,192\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"delete_clone\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png?w=300\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png?w=605\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png?w=605\" alt class=\"wp-image-5898\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png 605w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png?w=150 150w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png?w=300 300w\" sizes=\"(max-width: 605px) 100vw, 605px\"><\/figure>\n<p>And:<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" data-attachment-id=\"5900\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/reset_clone\/\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_clone.png\" data-orig-size=\"605,192\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"reset_clone\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_clone.png?w=300\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_clone.png?w=605\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_clone.png?w=605\" alt class=\"wp-image-5900\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_clone.png 605w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_clone.png?w=150 150w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_clone.png?w=300 300w\" sizes=\"(max-width: 605px) 100vw, 605px\"><\/figure>\n<p>If you try the same with the \u201c\u2013mirror\u201d option, you can now retrieve the secret (also note the larger number of objects retrieved):<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" data-attachment-id=\"5902\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/delete_mirror\/\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_mirror.png\" data-orig-size=\"669,412\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"delete_mirror\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_mirror.png?w=300\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_mirror.png?w=669\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_mirror.png?w=669\" alt class=\"wp-image-5902\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_mirror.png 669w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_mirror.png?w=150 150w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_mirror.png?w=300 300w\" sizes=\"(max-width: 669px) 100vw, 669px\"><\/figure>\n<p>And:<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" data-attachment-id=\"5903\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/reset_mirror\/\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_mirror.png\" data-orig-size=\"669,412\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"reset_mirror\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_mirror.png?w=300\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_mirror.png?w=669\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_mirror.png?w=669\" alt class=\"wp-image-5903\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_mirror.png 669w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_mirror.png?w=150 150w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/reset_mirror.png?w=300 300w\" sizes=\"(max-width: 669px) 100vw, 669px\"><\/figure>\n<p>If you run <a href=\"https:\/\/github.com\/zricethezav\/gitleaks\">gitleaks<\/a> on the cloned repositories, no secrets are found:<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"alignleft size-large\"><img decoding=\"async\" data-attachment-id=\"5913\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/gitleaks_delete_clone\/\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_clone.png\" data-orig-size=\"314,210\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"gitleaks_delete_clone\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_clone.png?w=300\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_clone.png?w=314\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_clone.png?w=314\" alt class=\"wp-image-5913\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_clone.png 314w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_clone.png?w=150 150w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_clone.png?w=300 300w\" sizes=\"(max-width: 314px) 100vw, 314px\"><\/figure>\n<\/div>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" data-attachment-id=\"5915\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/gitleaks_delete_mirror\/\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_mirror.png\" data-orig-size=\"314,210\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"gitleaks_delete_mirror\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_mirror.png?w=300\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_mirror.png?w=314\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_mirror.png?w=314\" alt class=\"wp-image-5915\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_mirror.png 314w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_mirror.png?w=150 150w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_delete_mirror.png?w=300 300w\" sizes=\"(max-width: 314px) 100vw, 314px\"><\/figure>\n<p>However, running <a href=\"https:\/\/github.com\/zricethezav\/gitleaks\">gitleaks<\/a> on the mirrored copies, finds the secrets stashed in deleted areas:<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"alignleft size-large\"><img decoding=\"async\" data-attachment-id=\"5917\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/gitleaks_reset_clone\/\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_clone.png\" data-orig-size=\"437,516\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"gitleaks_reset_clone\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_clone.png?w=254\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_clone.png?w=437\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_clone.png?w=437\" alt class=\"wp-image-5917\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_clone.png 437w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_clone.png?w=127 127w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_clone.png?w=254 254w\" sizes=\"(max-width: 437px) 100vw, 437px\"><\/figure>\n<\/div>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" data-attachment-id=\"5918\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/gitleaks_reset_mirror\/\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_mirror.png\" data-orig-size=\"437,516\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"gitleaks_reset_mirror\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_mirror.png?w=254\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_mirror.png?w=437\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_mirror.png?w=437\" alt class=\"wp-image-5918\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_mirror.png 437w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_mirror.png?w=127 127w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitleaks_reset_mirror.png?w=254 254w\" sizes=\"(max-width: 437px) 100vw, 437px\"><\/figure>\n<p>There are plenty of existing tools out there that can manipulate git repositories, scan them for secrets and remove specific commits. During our research, we used git for checking out repositories, <a href=\"https:\/\/github.com\/newren\/git-filter-repo\">git-filter-repo<\/a> for figuring out the delta between cloned and mirrored copies of the same repository, and <a href=\"https:\/\/github.com\/zricethezav\/gitleaks\">gitleaks<\/a> to scan for secrets.<\/p>\n<p>For examples on how to use these tools, please see sample scripts that we have <a href=\"https:\/\/github.com\/nightwatchcybersecurity\/gitbleed_tools\">published to GitHub<\/a>.<\/p>\n<h2 id=\"mitigations\">Mitigations<\/h2>\n<p>Organizations can mitigate this by analyzing a larger part of their repositories using the \u201c\u2013mirror\u201d option and remove sensitive data using tools like <a href=\"https:\/\/rtyley.github.io\/bfg-repo-cleaner\/\">BFG<\/a> or <a href=\"https:\/\/github.com\/newren\/git-filter-repo\">git-filter-repo<\/a>. Garbage collection and pruning in git is also recommended.<\/p>\n<p>Organizations should not analyze regular cloned copies (without the \u201c\u2013mirror\u201d option) since that may provide a false sense of security, and should not rely on methods of removing secrets such as deleting a branch or rewinding history via the \u201c<a href=\"https:\/\/git-scm.com\/docs\/git-reset\">git reset<\/a>\u201d command.<\/p>\n<h2 id=\"branding\">Branding<\/h2>\n<div class=\"wp-block-image is-style-rounded\">\n<figure class=\"alignleft size-large is-resized\"><a href=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitbleed_icon-3.png\"><img decoding=\"async\" loading=\"lazy\" data-attachment-id=\"5889\" data-permalink=\"https:\/\/wwws.nightwatchcybersecurity.com\/2022\/02\/11\/gitbleed\/gitbleed_icon-3\/#main\" data-orig-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitbleed_icon-3.png\" data-orig-size=\"383,383\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"gitbleed_icon\" data-image-description data-image-caption data-medium-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitbleed_icon-3.png?w=300\" data-large-file=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitbleed_icon-3.png?w=383\" src=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitbleed_icon-3.png?w=383\" alt=\"logo\" class=\"wp-image-5889\" width=\"96\" height=\"96\" srcset=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitbleed_icon-3.png?w=96 96w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitbleed_icon-3.png?w=192 192w, https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/gitbleed_icon-3.png?w=150 150w\" sizes=\"auto, (max-width: 96px) 100vw, 96px\"><\/a><\/figure>\n<\/div>\n<p>There seems to be a recent trend to name vulnerabilities. While we think it\u2019s silly, why not go with the flow?<\/p>\n<p>Therefore we named this one \u201c<strong>GitBleed<\/strong>\u201c, since it leads to bleeding of secrets from repositories \u2013 with <a href=\"https:\/\/github.com\/nightwatchcybersecurity\/gitbleed_tools\/blob\/main\/gitbleed_icon.png\">a mirrored logo<\/a> since it involves mirrored repositories.<\/p>\n<h2 id=\"changelog\">Changelog<\/h2>\n<p>2022-02-11: Initial publication<\/p>\n<div id=\"jp-post-flair\" class=\"sharedaddy sd-like-enabled sd-sharing-enabled\">\n<div class=\"sharedaddy sd-sharing-enabled\">\n<div class=\"robots-nocontent sd-block sd-social sd-social-icon-text sd-sharing\">\n<h3 class=\"sd-title\">Share this:<\/h3>\n<\/div>\n<\/div>\n<div class=\"sharedaddy sd-block sd-like jetpack-likes-widget-wrapper jetpack-likes-widget-unloaded\" id=\"like-post-wrapper-113089212-5878-620acebff2543\" data-src=\"\/\/widgets.wp.com\/likes\/index.html?ver=20220105#blog_id=113089212&amp;post_id=5878&amp;origin=wwwsnightwatchcybersecuritycom.wordpress.com&amp;obj_id=113089212-5878-620acebff2543&amp;domain=wwws.nightwatchcybersecurity.com\" data-name=\"like-post-frame-113089212-5878-620acebff2543\" data-title=\"Like or Reblog\">\n<h3 class=\"sd-title\">Like this:<\/h3>\n<div class=\"likes-widget-placeholder post-likes-widget-placeholder\"><span class=\"button\"><span>Like<\/span><\/span> <span class=\"loading\">Loading&#8230;<\/span><\/div>\n<p><span class=\"sd-text-color\"><\/span><\/div>\n<\/div>\n<p> READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/33107\/GitBleed-Finding-Secrets-In-Mirrored-Git-Repositories.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":45289,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[60],"tags":[2062],"class_list":["post-45288","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-packet-storm","tag-headlinedata-losspassword"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>GitBleed - Finding Secrets In Mirrored Git Repositories 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GitBleed - Finding Secrets In Mirrored Git Repositories 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-14T17:24:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png?w=605\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"GitBleed &#8211; Finding Secrets In Mirrored Git Repositories\",\"datePublished\":\"2022-02-14T17:24:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/\"},\"wordCount\":600,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/02\\\/gitbleed-finding-secrets-in-mirrored-git-repositories.png\",\"keywords\":[\"headline,data loss,password\"],\"articleSection\":[\"Packet Storm\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/\",\"name\":\"GitBleed - Finding Secrets In Mirrored Git Repositories 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/02\\\/gitbleed-finding-secrets-in-mirrored-git-repositories.png\",\"datePublished\":\"2022-02-14T17:24:31+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/02\\\/gitbleed-finding-secrets-in-mirrored-git-repositories.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/02\\\/gitbleed-finding-secrets-in-mirrored-git-repositories.png\",\"width\":605,\"height\":192},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gitbleed-finding-secrets-in-mirrored-git-repositories\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,data loss,password\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinedata-losspassword\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"GitBleed &#8211; Finding Secrets In Mirrored Git Repositories\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GitBleed - Finding Secrets In Mirrored Git Repositories 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/","og_locale":"en_US","og_type":"article","og_title":"GitBleed - Finding Secrets In Mirrored Git Repositories 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-02-14T17:24:31+00:00","og_image":[{"url":"https:\/\/wwwsnightwatchcybersecuritycom.files.wordpress.com\/2022\/02\/delete_clone.png?w=605","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"GitBleed &#8211; Finding Secrets In Mirrored Git Repositories","datePublished":"2022-02-14T17:24:31+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/"},"wordCount":600,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/02\/gitbleed-finding-secrets-in-mirrored-git-repositories.png","keywords":["headline,data loss,password"],"articleSection":["Packet Storm"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/","url":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/","name":"GitBleed - Finding Secrets In Mirrored Git Repositories 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/02\/gitbleed-finding-secrets-in-mirrored-git-repositories.png","datePublished":"2022-02-14T17:24:31+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/02\/gitbleed-finding-secrets-in-mirrored-git-repositories.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/02\/gitbleed-finding-secrets-in-mirrored-git-repositories.png","width":605,"height":192},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/gitbleed-finding-secrets-in-mirrored-git-repositories\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,data loss,password","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinedata-losspassword\/"},{"@type":"ListItem","position":3,"name":"GitBleed &#8211; Finding Secrets In Mirrored Git Repositories"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/45288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=45288"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/45288\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/45289"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=45288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=45288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=45288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}