3 ms·

You can use tools like Talisman which registers a Git hook to check if you are checking in anything that looks like secret. https://github.com/thoughtworks/tal

You can use tools like Talisman which registers a Git hook to check if you are checking in anything that looks like secret. https://github.com/thoughtworks/talisman https://github.com/thoughtworks/talisman

anaphylactic 9y ago
It's not foolproof but this tool needs to be more widely-known - it would've saved me on countless occasions.
lhinds 9y ago
We use a tool under a Linux Foundation project called anteater https://github.com/opnfv/releng-anteater https://github.com/opnfv/releng-anteater, which does the same thing (but is for a jenkins / gerrit workflow). A key difference from looking at talisman, is anteater uses standard RegEx rather then code to seek out strings, so anyone can add their own strings / file names easily into a simple yaml file. Like wise they can use regex to provide a waiver, should something be incorrectly reported. I am thinking now would be a good time to port it to working with webhooks as well. The tool would have blocked the aws credentials from being checked in: https://github.com/opnfv/releng-anteater/blob/master/master_list.yaml#L55 https://github.com/opnfv/releng-anteater/blob/master/master_...