Commit Security

It's quite usual that people push their credentials to a public git repo on the internet. What published is published, a push -f does not unpublish, and recovery isn't that obscure.

The Idea

There's no magic in finding secrets in your repo, a simple grepping with --recursive --ignore-case --only for common patterns for secrets will do the job, like grep -rio "begin private" will point out any offenders that have PEM secret keys.

For basics, have a list of regexes (or regexen?) in a .sh will do, and a bonus point for {push|commit}-hook.

Existing Tools

Instead of incubating our own, there are plenty of them on the Github.

awslab/git-secrets

It's just a well-documented shell document, with very basic functionality, but pretty easy to extend. Anyway, it just ships with aws rules.

apuigsech/git-seekret

A Golang implementation, bundled with a lot of common rules, sort of set and forget tool.

Yelp/detect-secrets-server

It's a server, as so told in the name. It's not really security, but a safety scanner, you'll know when there's a leak. Very useful for continued watching.

Extending git-secrets a bit

I would go for git-seekret if I wasn't already using git-secret.

I have added a few patterns to prevent DEBUG log and secrets from being commited:

# PRIVATE Keys
git secrets --global --add "\-+.*PRIVATE"
# Tokens
git secrets --global --add "(access|id|refresh)_token"
# Debug Logs
git secrets --global --add "\d{4}.\d{2}.\d{2}.\d{2}.\d{2}.\d{2}.\d+.(DEBUG|TRACE)"