gitrob

I wrote something* that checks the entropy of strings found in incoming webhook commit payloads. It catches a good amount of secrets, but even more false flags. I have to work on honing it in. I'm not sure about hosted solutions but there are some great open source tools that scan entire repos as well as their history. I have used, and like, Gitrob and Trufflehog. * https://github.com/michenriksen/gitrob * https://github.com/dxa4481/truffleHog * * not currently OSS unfortunately

Yeah, I'd love to try it. However, I'm at work and that's where I would be trying it - and I can't. Aside from intellectual policy problems, in large codebases mistakes happen, including api keys being committed and pushed. You see it even in open source projects, and tools like gitrob[1] exist to exploit that. You can see how both of those example issues are problematic, if even a snapshot of your codebase is being pushed off-site. I think this is a crucially important feature for any large enterprise that has a codebase that is a significant effort of R&D resources. Don't get me wrong, there are cloud services like github being used by medium to large shops, but the missing visibility into those decisions is that those choices are often regularly heavily vetted by security, legal, and engineering resources. 1 https://github.com/michenri

Open source alternatives for Git repos (ideally run in the pipeline): https://github.com/dxa4481/truffleHog - "Searches through git repositories for high entropy strings, digging deep into commit history" https://github.com/ezekg/git-hound - "Hound is a Git plugin that helps prevent sensitive data from being committed into a repository by sniffing potential commits against PCRE regular expressions" https://github.com/michenriksen/gitrob - "The tool will iterate over all public organization and member repositories and match filenames against a range of patterns for files that typically contain sensitive or dangerous information" https://github.com/awslabs/git-secrets - "Prevents you from committing passwords and other sensitive information to a git repository"