detect-secrets

A similar tool is detect-secrets[1]. [1] https://github.com/Yelp/detect-secrets

Besides the obvious takeaway of the story, to anyone who reads this: use pre-commit hooks to avoid this kind of problems (or something equivalent). With the pre-commit framework, an example hook would be https://github.com/Yelp/detect-secrets

See also: - trufflehog: https://github.com/trufflesecurity/trufflehog - detect-secrets: https://github.com/Yelp/detect-secrets - semgrep secrets: https://semgrep.dev/products/semgrep-secrets -- (Paid, but may be included in existing licenses in some cases

You can put something like detect-secrets[1] in a commit hook. no_secrets=$(git diff --staged --name-only -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline) test -z $no_secrets && exit $no_secrets 1: https://github.com/Yelp/detect-secrets

I've used sync-secrets before, which has worked well- https://github.com/Yelp/detect-secrets

Search your existing code for secrets. Review all your commits before pushing. Some tools can help with that: https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://about.sourcegraph.com/blog/no-more-secrets https://github.com/Yelp/detect-secrets https://docs.github.com/en/developers/overview/secret-scanni... https://github.com/godaddy/tartufo https://github.com/GitGuardian/ggshield https://github.com/awslabs/git-secrets https://github.com/sirwart/secrets https://thoughtworks.github.io/talisman/ https://gitleaks.io/

Yelp has a "detect-secrets" project that can detect potential secrets and can be used as a pre-commit hook: https://github.com/Yelp/detect-secrets

Neat! I really like the crowdsourcing element where you can easily comment on the gist to make the author aware. Would something like https://github.com/Yelp/detect-secrets be interesting to include? Either as a filtering step to weed out false positives or to find even more secrets (i.e. that aren't near "password" or "secret")

Yeah, I'm not sure why this is such a problem. At work we tried out using detect-secrets[1] for a while to make sure we didn't accidentally commit anything important. It was a huge pain, it picked up nothing but false positives. After a few months we decided that our pre-existing practices: have secrets passed to the app in environment variables which are set during deployment, and use fake secrets for test and dev, solved the problem in a much less painful way. Is it so hard to keep real secrets separate from the source code? [1] https://github.com/Yelp/detect-secrets

This is the wrong answer. At a company I worked at, we had a well known saying: "Favor mechanisms over good intentions." As the saying went, if good intentions worked, we "wouldn't need mechanisms." The right answer here (as stated in sibling comments) is to install a mechanism into the build. A push that accidentally commits credentials should break the build. How it goes about doing that is up to you, but the specific way I've done that in the past is a git hook [1] specifically the pre-commit hook. It looks like there's a reasonably well-updated package by Yelp to help do this kind of thing [2]. [1] https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks [2] https://github.com/Yelp/detect-secrets

Pre-commit.com has built in checks for AWS and SSH keys. I add this hook which checks for passwords, high-entropy strings, etc. and has tools for managing false positives: https://github.com/Yelp/detect-secrets

you will need to glue together (and maintain) a bunch of different open-source projects to achieve the same capabilities - here are some: https://github.com/danger/danger-js, https://github.com/probot/probot, https://github.com/Yelp/detect-secrets, https://github.com/github/licensed, and many more...