secrets-detection

Secrets Detection

Find and prevent leaked API keys, passwords, and credentials in your codebase.

When to Use

• Reviewing code for hardcoded secrets
• Setting up CI/CD security checks
• Auditing git history for leaks
• Configuring pre-commit hooks
• Responding to secret exposure incidents

Common Secret Patterns

Secret Type	Pattern Example
AWS Access Key	AKIA[0-9A-Z]{16}
AWS Secret Key	40-character base64
GitHub Token	ghp_[a-zA-Z0-9]{36}
Stripe API Key	sk_live_[a-zA-Z0-9]{24}
Private Key	-----BEGIN RSA PRIVATE KEY-----
JWT Secret	High entropy string

Detection Tools

1. Gitleaks (Recommended)

# Install
brew install gitleaks

# Scan current directory
gitleaks detect -v

# Scan git history
gitleaks detect --source . -v

# CI/CD integration
gitleaks detect --source . --exit-code 1

# .gitleaks.toml - Custom rules
[allowlist]
  paths = [
    '''vendor/''',
    '''node_modules/''',
    '''\.test\.'''
  ]

[[rules]]
  description = "Custom API Key"
  id = "custom-api-key"
  regex = '''myapp_[a-zA-Z0-9]{32}'''
  tags = ["key", "custom"]

2. git-secrets (AWS)

# Install
brew install git-secrets

# Add AWS patterns
git secrets --register-aws

# Scan repository
git secrets --scan

# Install hooks
git secrets --install

3. TruffleHog

# Scan repository
trufflehog git file://. --only-verified

# Scan GitHub org
trufflehog github --org=myorg --only-verified

# CI/CD
trufflehog git file://. --fail --only-verified

Pre-Commit Hooks

Husky + lint-staged

npm install -D husky lint-staged
npx husky init

// package.json
{
  "lint-staged": {
    "*.{js,ts,jsx,tsx}": [
      "gitleaks detect --no-git -v"
    ]
  }
}

# .husky/pre-commit
#!/bin/sh
npx lint-staged
gitleaks protect --staged -v

Pre-commit Framework

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

  - repo: https://github.com/awslabs/git-secrets
    rev: master
    hooks:
      - id: git-secrets

  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']