if the provider gets popped doesn't the binary get popped too? then simply use an LLM to reverse engineer the binary and get the key?
if the provider gets popped doesn't the binary get popped too? then simply use an LLM to reverse engineer the binary and get the key?
If its a targeted attack, they'll know and probably "crack" it. If its just data trawling, you might get owned one day if they bother, but likely the env `AWS_KEY=encrypted_abc` looks reasonably close to `AWS_KEY=unencrypted_abc` and any API key probing will just look like it got rotated already.
I think siblings are correct that the more widespread this is, the less effective once every dump is run through a "also look for keys in the binary" step.