4 ms·
Methodology is super important here though. I've used static analysis tools that identify every single bit of fake unit test data with a field called 'username'
by p1necone 3y ago
Methodology is super important here though. I've used static analysis tools that identify every single bit of fake unit test data with a field called 'username', 'email' etc as leaked credentials.
- cowsup 3y agoGood point. I wish they included more details about how they performed their searches, but I understand not wanting to feed tips and tricks to the bad guys...
- lamontcg 3y agoYeah, for $curious_reasons we shipped our unit tests with our binaries and fake credentials would set off enterprise security scanners (although in our case it was a real enough looking PKI cert and not just data with username/password fields in it).
- simonw 3y agoIt looks like the best description of the methodology is here: https://docs.gitguardian.com/secrets-detection/detectors/generics/generic_high_entropy_secret https://docs.gitguardian.com/secrets-detection/detectors/gen... It's pretty much checking if there's a variable called "_token" or "_secret" or similar which is then assigned to a string matching a regex looking for high entropy random-looking values.