secret-detection

Secret Detection

When to Use

• Auditing a codebase for accidentally committed credentials
• Before open-sourcing a private repository
• After a developer reports a potential secret leak
• As part of a regular security review cadence
• Setting up pre-commit hooks for secret prevention

Prerequisites

• Access to the repository source code and git history
• Ability to rotate compromised credentials
• Access to a secrets manager or environment variable configuration

Workflow

1. Scan Source Code for Secret Patterns

# AWS Access Keys
grep -rn "AKIA[0-9A-Z]{16}" . --include="*.ts" --include="*.js" --include="*.py" --include="*.json"

# GitHub tokens
grep -rn "ghp_[a-zA-Z0-9]{36}\|github_pat_[a-zA-Z0-9_]{82}" .

# Generic API keys and secrets
grep -rni "api[_-]?key\s*[:=]\s*['\"][a-zA-Z0-9]" src/ --include="*.ts" --include="*.js"

# Private keys
grep -rn "BEGIN.*PRIVATE KEY" .

# Connection strings with credentials
grep -rni "mongodb\+srv://\|postgres://\|mysql://" . | grep -v "localhost\|example\|template"

# JWT secrets and signing keys
grep -rni "jwt[_]?secret\|signing[_]?key" src/ --include="*.ts" | grep -v "process\.env\|config\."

2. Check for Secret Files

# Find committed secret files
git --no-pager ls-files | Select-String "\.pem$|\.key$|\.p12$|\.pfx$|id_rsa|\.env$"

# Check .gitignore covers sensitive patterns
Get-Content .gitignore 2>$null | Select-String "\.env|\.pem|\.key|secret"

3. Scan Git History

Secrets removed from code may still exist in git history:

# Search recent commits for secret patterns
git --no-pager log --all -p --since="6 months ago" -S "AKIA" --oneline | Select-Object -First 20

# Search for common secret keywords in diffs
git --no-pager log --all -p -S "api_key" --oneline | Select-Object -First 20

4. Remediate Found Secrets

Step 1: Rotate the credential immediately Any secret found in source code should be considered compromised.

Step 2: Replace with environment variables