zricethezav

5 ms·

1.
by zricethezav 5mo ago
I've been working on Betterleaks for the past three months. It's the successor to Gitleaks since I'm not focused on that project much anymore. I just released v1.2.0 which added GitHub as a source to scan for secrets against
2.
I wrote Gitleaks, now I'm maintaining Betterleaks(aikido.dev)
15 points by zricethezav 7mo ago|3 comments
3.
by zricethezav 7mo ago
8 years ago I wrote the first lines of Gitleaks and have been hooked on finding leaked secrets since. Gitleaks grew from a small project to a name recognized by developers and security folks. It sucks but I gotta take a step back from the p
4.
by zricethezav 2y ago
looks familiar
5.
by zricethezav 3y ago
> gitleaks : fatal error: runtime: out of memory Should be fixed now: https://github.com/gitleaks/gitleaks/pull/1292 . Thanks for highlighting this simple change I've been putting off :)
6.
Live API Keys and Source Code Leaked in 4,500 of the Top Alexa Sites(trufflesecurity.com)
13 points by zricethezav 3y ago|0 comments
7.
Show HN: Forager – Browse millions of live secrets leaked from GitHub/NPM(trufflesecurity.com)
2 points by zricethezav 3y ago|0 comments
8.
by zricethezav 3y ago
Agreed! 1/1000 is pretty frequent considering how many pushes to GitHub happen every single day. Folks probably get a false sense of security thinking no one is looking at their personal repos (spoiler alert... they are!)
9.
Browse millions of secrets leaked in GitHub/NPM via Forager(trufflesecurity.com)
11 points by zricethezav 3y ago|3 comments
10.
by zricethezav 4y ago
Gitleaks also offers a nice pre-commit hook: https://github.com/zricethezav/gitleaks#pre-commit
11.
by zricethezav 4y ago
Good reminder to run Gitleaks or Gitleaks-Action on your repos - https://github.com/zricethezav/gitleaks - https://gitleaks.io/products
12.
by zricethezav 4y ago
If using GitHub-Actions, Gitleaks offers competitive pricing for a secret scanning solution. https://gitleaks.io/products
13.
by zricethezav 4y ago
I'm doing something similar with gitleaks: https://gitleaks.io/support.html So far it's working out great.
14.
by zricethezav 4y ago
I recently tried my hand in commercializing my open source project, gitleaks ( http://gitleaks.io ). I'm keeping the core gitleaks project MIT but changed the gitleaks-action on GitHub to a commercial license. Revenue from th
15.
by zricethezav 4y ago
Good reminder to run https://gitleaks.io on your projects
16.
by zricethezav 4y ago
hardcoded creds in example documentation... T_T Use vault, env vars, GitHub/GitLab secrets, anything but string literals!!!
17.
by zricethezav 4y ago
`pass` by itself might introduce false positives. `passwd` and `password` are common and more likely to be in the ROI of a secret. That said, I'm not opposed to `pass` by itself. I'll have to think about this one... > but I ass
18.
by zricethezav 4y ago
More and more providers have been adding unique prefixes to their tokens and access keys which makes detection much easier. Ex, GitLab adds `glpat-` to their PAT. A project I maintain, Gitleaks, can easily detect "unique" secrets
19.
by zricethezav 4y ago
Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the
20.
by zricethezav 4y ago
monodraw - https://monodraw.helftone.com/ like paint but for ascii art I used it to come up with the new gitleaks logo: https://github.com/zricethezav/gitleaks
21.
by zricethezav 5y ago
Speaking of credentials, you can use https://github.com/zricethezav/gitleaks to check if your repos contain any secrets
22.
by zricethezav 8y ago
I made a similar tool https://github.com/zricethezav/gitleaks Reasons why you might want to use gitleaks over this: * performance (powered by go-git) * scan github orgs/users * ref targeting
23.
by zricethezav 9y ago
Lever link doesn't work
24.
by zricethezav 9y ago
Nice, I was thinking about building something like this but was turned off by the potential legal ramifications. How is this legal? Is this within fair use of the original author of the article?