2

I've been tasked to find secrets in a list of Git repositories.

A secret can be:

  • A password
  • An encryption key
  • An API key
  • A passphrase
  • Anything else I may not like to see in plain text in the wild ;)

The objective is to find and rotate any secrets before these repositories are made public.

Is there any software that could help me out in this task?

1

I decided to use git-secrets from AWSLabs and wanted to share my experience.


The canonical source for this example lives at https://github.com/customcommander/git-secrets-examples


How To Install?

Fetch the latest release, unzip it and build it with Make. The git-secrets binary should now be in your PATH. e.g.,

curl -L -o /tmp/git-secrets.zip https://github.com/awslabs/git-secrets/archive/1.3.0.zip
cd /tmp
unzip git-secrets.zip
cd git-secrets-1.3.0
make install

You're not done yet! It now must be installed as a Git hook in each Git repository you would like to inspect. e.g.,

cd /path/to/repo
git-secrets --install

How To Find Secrets In A Git Repository?

We'll be looking for the following patterns:

  • token
  • username
  • password

We want to know which files match these patterns in the current source tree and across the entire Git history.

To demonstrate the capabilities of git-secrets will add the first pattern from the CLI:

# at the root of the repo
git secrets --add token

The two other patterns will be loaded from a file /var/forbidden-patterns.txt:

username
password
# at the root of the repo
git secrets --add-provider -- cat /var/forbidden-patterns.txt

Now let's add the following files to our Git repo:

First secrets-1.txt:

username=abc
password=123
# at the root of your repo
git add secrets-1.txt
git commit -m "add secrets-1.txt"
# please note that we're now removing the file!
git rm secrets-1.txt
git commit -m "remove secrets-1.txt"

Then secrets-2.txt:

token=123456789
# at the root of your repo
git add secrets-2.txt
git commit -m "add secrets-2.txt"

Now let's scan the current source tree:

# at the root of your repo
git secrets --scan

Which outputs:

secrets-2.txt:1:token=123456789

It hasn't found secrets-1.txt because that file has been deleted. However we also want to make sure we're not exposing secrets in the Git history. Let's do that:

git secrets --scan-history

Which outputs:

c5e7f9887ed95f7d3aeb4ed011a8235e238b9ed1:secrets-2.txt:1:token=123456789
c0082ddbb0e2b14499808b376e133a6fbb5799cc:secrets-1.txt:1:username=abc
c0082ddbb0e2b14499808b376e133a6fbb5799cc:secrets-1.txt:2:password=123

We now can see in which commits a secret has been found.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.