trufflehog

But trufflehog supports docker images already? The trufflehog readme has examples[0] # to scan from a remote registry trufflehog docker --image trufflesecurity/secrets # to scan from the local docker daemon trufflehog docker --image docker://new_image:tag # to scan from an image saved as a tarball trufflehog docker --image file://path_to_image.tar [0]: https://github.com/trufflesecurity/trufflehog#11-scan-a-dock...

Tools like TruffleHog[1] will attempt to verify any credentials it finds by making some sort of authenticated request. [1] https://github.com/trufflesecurity/trufflehog#validation-

Will monitor your progress Also be interesting to see what trufflehog finds (should be false positive) https://github.com/trufflesecurity/trufflehog Where are you storing the creds to get the secret from the vault? This is the secret zero problem and other platforms solve it in other ways such as HSM

https://github.com/trufflesecurity/trufflehog is a similar tool but checks for far more secrets, so I think it'd be a better choice.

It's probably either that they took the picture a while ago, or they were going character by character and accidentally screenshot with one too few. All of these are valid right now, and the first one is the one they show: https://github.com/trufflesecurity/trufflehog/commit/7bc0b2 https://github.com/trufflesecurity/trufflehog/commit/7bc0b4 https://github.com/trufflesecurity/trufflehog/commit/7bc0b8 https://github.com/trufflesecurity/trufflehog/commit/7bc0b8

I cannot access the commit https://github.com/trufflesecurity/trufflehog/commit/7bc0b shown in one of the pictures in the article (right before "Where do you get these hash values") despite this repo is even public. What gives?

See also: - trufflehog: https://github.com/trufflesecurity/trufflehog - detect-secrets: https://github.com/Yelp/detect-secrets - semgrep secrets: https://semgrep.dev/products/semgrep-secrets -- (Paid, but may be included in existing licenses in some cases

I think Trivy does that already [1]. I personally use trufflehog [2] to find secrets of all kinds. Unfortunately, these sorts of tools have false positives [1] https://aquasecurity.github.io/trivy/v0.27.1/docs/secret/sca... [2] https://github.com/trufflesecurity/trufflehog

Frankly, I think it will take years to replace API-keys (if it will ever happen). Developers are much better-off using CLI tools that prevent leaking secrets by blocking commits to git (e.g., https://github.com/Infisical/infisical or https://github.com/trufflesecurity/trufflehog)

Search your existing code for secrets. Review all your commits before pushing. Some tools can help with that: https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://about.sourcegraph.com/blog/no-more-secrets https://github.com/Yelp/detect-secrets https://docs.github.com/en/developers/overview/secret-scanni... https://github.com/godaddy/tartufo https://github.com/GitGuardian/ggshield https://github.com/awslabs/git-secrets https://github.com/sirwart/secrets https://thoughtworks.github.io/talisman/ https://gitleaks.io/

There are software such as Trufflehog ( https://github.com/trufflesecurity/trufflehog ), that find secrets. We are using it at an organizational level, but there's always some delay from finding something and getting it reported. I've been meaning to add it both to our CI so our team can notice right away, and even to Git push hooks, to catch these cases early.

There are a ton of them, here are a few: https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://github.com/awslabs/git-secrets https://github.com/sirwart/ripsecrets https://thoughtworks.github.io/talisman/ https://github.com/michenriksen/gitrob

then they must have rewritten the 2.0.97 tag from 2016 because it's AGPL also: https://github.com/trufflesecurity/trufflehog/blob/2.0.97/LI...