Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)

["dave2wave (via GitHub)" <gi...@apache.org>]

dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3499854750

   What's clear so far is that we are discussing this format `asf_${prefix}_`. I don't think we have agreed on how ${prefix} is chosen. I'm not sure that a obfuscated single character for the team that created it is best. A more application specific two or three letter code could be better. In infra docs somewhere we can keep a log of these codes as more kinds of tokens are created.
   
   With this idea `asf_atr_` would be the prefix for ATR tokens or `asf_aaa_` could be the prefix for Oath tokens.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org