Secrets Detector

Quick Start

Scan for secrets using gitleaks:

Install

brew install gitleaks # macOS

or

pip install detect-secrets

Scan current directory

gitleaks detect --source .

Instructions

Step 1: Choose Detection Tool

Gitleaks (recommended):

gitleaks detect --source . --verbose

detect-secrets:

detect-secrets scan . --all-files

Manual grep patterns:

grep -rn "AKIA[0-9A-Z]{16}" . # AWS Access Key grep -rn "ghp_[a-zA-Z0-9]{36}" . # GitHub Token

Step 2: Scan for Common Patterns

Secret Type Pattern Example

AWS Access Key AKIA[0-9A-Z]{16}

AKIAIOSFODNN7EXAMPLE

AWS Secret Key [A-Za-z0-9/+=]{40}

wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

GitHub Token ghp_[a-zA-Z0-9]{36}

ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

GitHub OAuth gho_[a-zA-Z0-9]{36}

gho_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Slack Token xox[baprs]-[0-9a-zA-Z-]+

xoxb-123456789-abcdefghij

Private Key -----BEGIN.*PRIVATE KEY-----

RSA/EC private keys

Generic API Key api[_-]?key.=.['"][a-zA-Z0-9]{20,}

api_key = "abc123..."

Generic Password password.=.['"][^'"]+['"]

password = "secret123"

Step 3: Check Git History

Secrets may exist in git history even if removed:

Scan entire git history

gitleaks detect --source . --log-opts="--all"

Check specific commits

git log -p --all -S 'password' --source

Step 4: Categorize Findings

Critical - Immediate rotation required:

• Cloud provider credentials (AWS, GCP, Azure)

• Database connection strings

• Private keys

High - Rotate soon:

• API keys for external services

• OAuth tokens

• Webhook secrets

Medium - Review and rotate:

• Internal service tokens

• Test credentials that might be reused

Step 5: Report Findings

Secrets Detection Report

Critical (1)

1. AWS Secret Key - config/aws.js:12
   • Type: AWS credentials
   • Action: Rotate immediately in AWS console

High (2)

1. GitHub Token - scripts/deploy.sh:45

   • Type: Personal access token
   • Action: Revoke and regenerate

2. Slack Webhook - src/notifications.js:23

   • Type: Incoming webhook URL
   • Action: Regenerate webhook

Prevention

Pre-commit Hook

.pre-commit-config.yaml

repos:

• repo: https://github.com/gitleaks/gitleaks rev: v8.18.0 hooks:
  • id: gitleaks

.gitignore Patterns

Environment files

.env .env.local .env.*.local

Key files

*.pem *.key *_rsa *_ecdsa *_ed25519

Config with secrets

config/secrets.yml credentials.json

Environment Variables

Move secrets to environment variables:

// BAD const apiKey = "sk-abc123...";

// GOOD const apiKey = process.env.API_KEY;

Common False Positives

• Example/placeholder values in documentation

• Test fixtures with fake credentials

• Base64-encoded non-secret data

• Hash values (SHA, MD5)

Review each finding to confirm it's a real secret before taking action.