3 ms·
There are tools available to help look for this sort of thing (for both you and any potential attackers). TruffleHog[1] is the first one that comes to mind for
by psanford 6y ago
There are tools available to help look for this sort of thing (for both you and any potential attackers). TruffleHog[1] is the first one that comes to mind for me.
I also like shhgit[2] for looking for secrets in repositories. (I don't think shhgit will look back in the git history for you though).
[1]: https://github.com/dxa4481/truffleHog https://github.com/dxa4481/truffleHog
[2]: https://github.com/eth0izzle/shhgit https://github.com/eth0izzle/shhgit
- amichal 6y agoThanks! I knew they existed but hadn't investigated for one that would look over past history. Will try out truffleHog.
- psanford 6y agoI've found the entropy detection in trufflehog to be pretty noisy. When I've run it I generally disable that.
- lstamour 6y agoAnother idea is to use a git commit hook, such as https://github.com/cloud-gov/caulking https://github.com/cloud-gov/caulking