Is that system made by a supervillain or a mad scientist? But such system can go amok for any reason. Anyway revocation is already possible by publication on github, telling to GPT or sending an email to webmaster.

▲

orf 17 hours ago | parent [-]

Credentials published on GitHub are not automatically revoked - what happens is at the discretion of the provider, for precisely this reason.

For example AWS applies a “quarantine” policy that prevents some specific actions[1].

Allowing anyone to report a potentially compromised key is one thing, but allowing anyone to unilaterally revoke a token is another.

1. https://docs.aws.amazon.com/aws-managed-policy/latest/refere...

	▲	GoblinSlayer 13 hours ago \| parent [-]
		The alternative is that the key won't be quarantined and the attacker will be able to do everything. And quarantine still means denial of some service, e.g. ec2:StartInstances is denied, but ec2:StopInstances is allowed? So the attacker can shut down the system and you won't be able to start it again?