I've been tasked to find secrets in a list of Git repositories.

A secret can be:

  • A password
  • An encryption key
  • An API key
  • A passphrase
  • Anything else I may not like to see in plain text in the wild ;)

The objective is to find and rotate any secrets before these repositories are made public.

Is there any software that could help me out in this task?


I decided to use git-secrets from AWSLabs and wanted to share my experience.

The canonical source for this example lives at https://github.com/customcommander/git-secrets-examples

How To Install?

Fetch the latest release, unzip it and build it with Make. The git-secrets binary should now be in your PATH. e.g.,

curl -L -o /tmp/git-secrets.zip https://github.com/awslabs/git-secrets/archive/1.3.0.zip
cd /tmp
unzip git-secrets.zip
cd git-secrets-1.3.0
make install

You're not done yet! It now must be installed as a Git hook in each Git repository you would like to inspect. e.g.,

cd /path/to/repo
git-secrets --install

How To Find Secrets In A Git Repository?

We'll be looking for the following patterns:

  • token
  • username
  • password

We want to know which files match these patterns in the current source tree and across the entire Git history.

To demonstrate the capabilities of git-secrets will add the first pattern from the CLI:

# at the root of the repo
git secrets --add token

The two other patterns will be loaded from a file /var/forbidden-patterns.txt:

# at the root of the repo
git secrets --add-provider -- cat /var/forbidden-patterns.txt

Now let's add the following files to our Git repo:

First secrets-1.txt:

# at the root of your repo
git add secrets-1.txt
git commit -m "add secrets-1.txt"
# please note that we're now removing the file!
git rm secrets-1.txt
git commit -m "remove secrets-1.txt"

Then secrets-2.txt:

# at the root of your repo
git add secrets-2.txt
git commit -m "add secrets-2.txt"

Now let's scan the current source tree:

# at the root of your repo
git secrets --scan

Which outputs:


It hasn't found secrets-1.txt because that file has been deleted. However we also want to make sure we're not exposing secrets in the Git history. Let's do that:

git secrets --scan-history

Which outputs:


We now can see in which commits a secret has been found.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.