Hacker News Reader

Comment by yawnxyz | Hacker News Reader

Are there any tools that check whether you're pushing keys and secrets BEFORE you've uploaded them to Github and it's already too late? E.g. checks your commits, and gives you a massive warning when you've committed something you're not supposed to? Even better if it prevents your commit from going through unless you force it

View on HN

How about a pre-commit hook?

https://github.com/pre-commit/pre-commit-hooks#detect-aws-cr...

Although a pre-commit hook exists for detecting AWS credentials, I can imagine other checks (e.g ssh credentials, passwords, etc)

Github itself has a product like this. It's better than the pre-commit hook approach since developers can turn that off (or never install it in the first place if you don't roll it out via MDM), and this centralized approach can't be bypassed.

But, even if you're on their enterprise plan it's still an additional addon (and expensive):

https://docs.github.com/en/enterprise-cloud@latest/code-secu...

There are a ton of them, here are a few:

https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://github.com/awslabs/git-secrets https://github.com/sirwart/ripsecrets https://thoughtworks.github.io/talisman/ https://github.com/michenriksen/gitrob

For people in the JS ecosystem theres this eslint rule: https://github.com/nickdeis/eslint-plugin-no-secrets

You can use commit hooks to script git

Reply on news.ycombinator.com