Skip to content

secrets-scan.md

Latest commit

 

History

History
49 lines (39 loc) · 1.76 KB

secrets-scan.md

File metadata and controls

49 lines (39 loc) · 1.76 KB

Scan the codebase for leaked secrets, API keys, tokens, and credentials.

Steps

  1. Define patterns to search for:
    • AWS keys: AKIA[0-9A-Z]{16}, aws_secret_access_key.
    • API keys: sk-[a-zA-Z0-9]{32,}, api[_-]?key\s*[:=].
    • Tokens: ghp_, gho_, github_pat_, xoxb-, xoxp-.
    • Private keys: -----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----.
    • Database URLs: (postgres|mysql|mongodb)://[^:]+:[^@]+@.
    • Generic secrets: password\s*[:=]\s*["'][^"']+["'], secret\s*[:=].
  2. Scan all tracked files: git ls-files (skip binary files).
  3. Also scan .env files that may not be tracked.
  4. Exclude known false positives (test fixtures, documentation examples, .env.example).
  5. For each finding, determine severity:
    • CRITICAL: Real credentials with high entropy that appear functional.
    • WARNING: Patterns that look like secrets but may be placeholders.
    • INFO: References to secret names without values.
  6. Check if .gitignore properly excludes sensitive files (.env, *.pem, *.key).
  7. Suggest remediation for each finding.

Format

Secrets Scan Results
====================

CRITICAL (immediate action required):
  - <file>:<line> - <type>: <masked-value>

WARNING (review needed):
  - <file>:<line> - <type>: <description>

.gitignore check:
  - [ ] .env files excluded
  - [ ] Key files excluded

Remediation:
  1. Rotate <credential type>
  2. Add <pattern> to .gitignore

Rules

  • Never print full secret values; mask all but the first 4 characters.
  • Scan both tracked and untracked files.
  • Check git history for secrets in past commits using git log -p --all -S.
  • Suggest .gitignore additions for any unprotected secret file patterns.
  • Recommend using environment variables or secret managers for all findings.