Secrets Detector
Quick Start
Scan for secrets using gitleaks:
Install
brew install gitleaks # macOS
or
pip install detect-secrets
Scan current directory
gitleaks detect --source .
Instructions
Step 1: Choose Detection Tool
Gitleaks (recommended):
gitleaks detect --source . --verbose
detect-secrets:
detect-secrets scan . --all-files
Manual grep patterns:
grep -rn "AKIA[0-9A-Z]{16}" . # AWS Access Key grep -rn "ghp_[a-zA-Z0-9]{36}" . # GitHub Token
Step 2: Scan for Common Patterns
Secret Type Pattern Example
AWS Access Key AKIA[0-9A-Z]{16}
AKIAIOSFODNN7EXAMPLE
AWS Secret Key [A-Za-z0-9/+=]{40}
wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
GitHub Token ghp_[a-zA-Z0-9]{36}
ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
GitHub OAuth gho_[a-zA-Z0-9]{36}
gho_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Slack Token xox[baprs]-[0-9a-zA-Z-]+
xoxb-123456789-abcdefghij
Private Key -----BEGIN.*PRIVATE KEY-----
RSA/EC private keys
Generic API Key api[_-]?key.=.['"][a-zA-Z0-9]{20,}
api_key = "abc123..."
Generic Password password.=.['"][^'"]+['"]
password = "secret123"
Step 3: Check Git History
Secrets may exist in git history even if removed:
Scan entire git history
gitleaks detect --source . --log-opts="--all"
Check specific commits
git log -p --all -S 'password' --source
Step 4: Categorize Findings
Critical - Immediate rotation required:
-
Cloud provider credentials (AWS, GCP, Azure)
-
Database connection strings
-
Private keys
High - Rotate soon:
-
API keys for external services
-
OAuth tokens
-
Webhook secrets
Medium - Review and rotate:
-
Internal service tokens
-
Test credentials that might be reused
Step 5: Report Findings
Secrets Detection Report
Critical (1)
- AWS Secret Key - config/aws.js:12
- Type: AWS credentials
- Action: Rotate immediately in AWS console
High (2)
-
GitHub Token - scripts/deploy.sh:45
- Type: Personal access token
- Action: Revoke and regenerate
-
Slack Webhook - src/notifications.js:23
- Type: Incoming webhook URL
- Action: Regenerate webhook
Prevention
Pre-commit Hook
.pre-commit-config.yaml
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.18.0
hooks:
- id: gitleaks
.gitignore Patterns
Environment files
.env .env.local .env.*.local
Key files
*.pem *.key *_rsa *_ecdsa *_ed25519
Config with secrets
config/secrets.yml credentials.json
Environment Variables
Move secrets to environment variables:
// BAD const apiKey = "sk-abc123...";
// GOOD const apiKey = process.env.API_KEY;
Common False Positives
-
Example/placeholder values in documentation
-
Test fixtures with fake credentials
-
Base64-encoded non-secret data
-
Hash values (SHA, MD5)
Review each finding to confirm it's a real secret before taking action.