4 ms·
Has anyone got a script or git hook that will suggest you not to push anything that looks like a credential? Could be really useful. It would need to identify
by lordnacho 4y ago
Has anyone got a script or git hook that will suggest you not to push anything that looks like a credential? Could be really useful.
It would need to identify strings that look like a key/password, and I guess also it would need an override, perhaps a comment like "// Demo password".
- Jeremy1026 4y agoGitHub has some protections that you can enable to help prevent this. https://github.blog/2022-04-04-push-protection-github-advanced-security/ https://github.blog/2022-04-04-push-protection-github-advanc...
- Xylakant 4y agoNote: paid add-on, and I believe it requires an enterprise subscription to start with. There exists some open source tooling in the same space.
- aeyes 4y agoThere are several tools which can be used with pre-commit, for example trufflehog.
- jonfw 4y agoI've used sync-secrets before, which has worked well- https://github.com/Yelp/detect-secrets https://github.com/Yelp/detect-secrets
- jrochkind1 4y agoI use one a git pre-commit hook that according to my notes i copied from here (at some point in the past, it may have changed since then): https://gist.github.com/czardoz/b8bb58ad10f4063209bd https://gist.github.com/czardoz/b8bb58ad10f4063209bd Then adapted with a better regex for secret keys I got from here: https://github.com/awslabs/git-secrets/blob/80230afa8c8bdeac766a0fece36f95ffaa0be778/git-secrets#L233-L242# https://github.com/awslabs/git-secrets/blob/80230afa8c8bdeac... (I think maybe I was getting false positives before)
- Dunedan 4y agoThe excellent pre-commit framework (https://pre-commit.com/ https://pre-commit.com/) has a hook for that in its official hook collection: https://github.com/pre-commit/pre-commit-hooks#detect-aws-credentials https://github.com/pre-commit/pre-commit-hooks#detect-aws-cr...