One of requirements I have in my work is that passwords cannot be hardcoded in source code, database dumps, scripts, etc.

However, scanning all this stuff manually and repeatedly gets tedious. Is there anything "off the shelf" that looks for password-like keywords and phrases in a file?

Sure, I can use grep with regex. But I'd prefer something that is custom-built for the task.

A very nice to have would be if it could search in a "fuzzy" manner instead of searching for fixed strings, searching for passwords, variables, database columns and content that resemble passwords or password locations.

  • The only chance is IMHO by searching for special patterns or the list of false positive will grow as the number of e.g. strings grow.
    – frlan
    Mar 18 '16 at 9:49
  • 1
    And if I don't call my variable password? If I code ingress = "letmein", how would your tool find that? I guess you can only dump all strings (which probably means your tool needs to be able to parse many coding languages). Or am I missing the point somehow? Mar 18 '16 at 12:37
  • @Mawg: if a tool is as dumb as grep, why use it in the first place instead of grep? I expect something more "intelligent" than that. Mar 23 '16 at 17:47
  • It occurs to me that you haven't told us whether you have a list of known passwords which you are searching for. When I first read this, I thought the password was supposed to look for anything that might be a password. Which is it, please? Nov 9 '18 at 11:35

Sonar Secrets is a plugin to SonarQube. It can recognize passwords, API keys, AWS credentials, tokens, etc. from source code.

You can read a nice introduction to it in https://medium.com/@SkyscannerEng/introducing-sonar-secrets-32e36e1bbc97

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.