4 ms·

Are there any tools that check whether you're pushing keys and secrets BEFORE you've uploaded them to Github and it's already too late? E.g. checks your commits

Are there any tools that check whether you're pushing keys and secrets BEFORE you've uploaded them to Github and it's already too late? E.g. checks your commits, and gives you a massive warning when you've committed something you're not supposed to? Even better if it prevents your commit from going through unless you force it

itsmemattchung 4y ago
How about a pre-commit hook? https://github.com/pre-commit/pre-commit-hooks#detect-aws-credentials https://github.com/pre-commit/pre-commit-hooks#detect-aws-cr... Although a pre-commit hook exists for detecting AWS credentials, I can imagine other checks (e.g ssh credentials, passwords, etc)
- deleted 4y ago
  [deleted]
bdhcuidbebe 4y ago
You can use commit hooks to script git
Fudgel 4y ago
For people in the JS ecosystem theres this eslint rule: https://github.com/nickdeis/eslint-plugin-no-secrets https://github.com/nickdeis/eslint-plugin-no-secrets
arkadiyt 4y ago
Github itself has a product like this. It's better than the pre-commit hook approach since developers can turn that off (or never install it in the first place if you don't roll it out via MDM), and this centralized approach can't be bypassed. But, even if you're on their enterprise plan it's still an additional addon (and expensive): https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-for-advanced-security https://docs.github.com/en/enterprise-cloud@latest/code-secu...
pabs3 4y ago
There are a ton of them, here are a few: https://martinfowler.com/articles/session-secret.html https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://github.com/trufflesecurity/trufflehog https://github.com/awslabs/git-secrets https://github.com/awslabs/git-secrets https://github.com/sirwart/ripsecrets https://github.com/sirwart/ripsecrets https://thoughtworks.github.io/talisman/ https://thoughtworks.github.io/talisman/ https://github.com/michenriksen/gitrob https://github.com/michenriksen/gitrob

itsmemattchung 4y ago

How about a pre-commit hook? https://github.com/pre-commit/pre-commit-hooks#detect-aws-credentials https://github.com/pre-commit/pre-commit-hooks#detect-aws-cr... Although a pre-commit hook exists for detecting AWS credentials, I can imagine other checks (e.g ssh credentials, passwords, etc)

deleted 4y ago
[deleted]

bdhcuidbebe 4y ago

You can use commit hooks to script git

Fudgel 4y ago

For people in the JS ecosystem theres this eslint rule: https://github.com/nickdeis/eslint-plugin-no-secrets https://github.com/nickdeis/eslint-plugin-no-secrets

arkadiyt 4y ago

Github itself has a product like this. It's better than the pre-commit hook approach since developers can turn that off (or never install it in the first place if you don't roll it out via MDM), and this centralized approach can't be bypassed. But, even if you're on their enterprise plan it's still an additional addon (and expensive): https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-for-advanced-security https://docs.github.com/en/enterprise-cloud@latest/code-secu...

pabs3 4y ago

There are a ton of them, here are a few: https://martinfowler.com/articles/session-secret.html https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://github.com/trufflesecurity/trufflehog https://github.com/awslabs/git-secrets https://github.com/awslabs/git-secrets https://github.com/sirwart/ripsecrets https://github.com/sirwart/ripsecrets https://thoughtworks.github.io/talisman/ https://thoughtworks.github.io/talisman/ https://github.com/michenriksen/gitrob https://github.com/michenriksen/gitrob