On October 7, GitHub introduced a new model for detecting secrets in code, including passwords that don't follow a recognizable pattern.
The goal is to catch more of them before code enters repository history.
That raises a related question: what needs to leave your device when you register your code?
A record without the source
I'm part of the team behind Ecode. It calculates a code file's SHA-256 fingerprint locally. Your source code isn't uploaded.
Ecode combines database registration, a trusted RFC 3161 timestamp, and a Polygon blockchain record.
You receive a certificate with a QR code for verification, a timestamp file, and a blockchain transaction link. Together with your original file and development history, these records can help support your authorship claim in a dispute.
Different jobs, both worth doing
Ecode doesn't scan for passwords or prevent leaks when you publish code elsewhere. Use security checks for that.
Its purpose is to create dated evidence to support code authorship without requiring you to disclose the source code for registration.
Registration is free. No card or subscription.
Top comments (0)