vietjovi / secret-detection

Finding your secret(Credential, API Key, AWS Key, Token, etc.) in your source code, files

secret-detection

secret-detection is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and sensitive information. secret-detection can run in the CLI or you can integrate it in your CI/CD pipeline.

Welcome to join in and feel free to contribute.

Feature

• Using regex rules to scan, and help identify the following types of secrets:
  • API Keys
  • AWS Keys
  • OAuth Client Secrets
  • SSH Private Keys
  • ...
• Supports whitelisting files
• Supports custom rules
• Lightweight
• Easy to customize to your needs

USAGE

python3 secret-detection.py --rule /path/to/pattern.json --path /path/to/scan
Ex: python3 secret-detection.py --rule pattern.json --path test/

• The ignored list: add patterns for filenames that you want to ignore. Default: ignored = ['.git', 'node_modules', 'bower_components', '.sass-cache', '.png', '.ico', '.mov', '.jpeg', 'jpg', '.avi', '.gif', '.apk', '.exe', '.jar', '.dmg', '.pdf', '.ipa', '.svg']

OUTPUT

Reason: API KEY

<string name="newrelic_key">HSUFAHSIUYCd7491274LFCAdgdsdgdgdgasdg</string>
~~~~~~~~~~~~~~~~~~~~~


~~~~~~~~~~~~~~~~~~~~~
Filepath: test/test.txt : Line 18
Reason: Sendgrid API

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
~~~~~~~~~~~~~~~~~~~~~


~~~~~~~~~~~~~~~~~~~~~
Filepath: test/test.txt : Line 20
Reason: Sendgrid API

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
~~~~~~~~~~~~~~~~~~~~~

You also can integrate the tool into CI/CD pipeline

Wish List:

1. Json Ouput
2. Entropy
3. Integrate to Git
4. Integrate with BurpSuite/ZAP/Jenkins/SonarQube
5. ...

License

This project is licensed under the terms of the MIT license.