HN user
Author of Gitleaks/Maintainer of Betterleaks
Looking for secrets
I've been working on Betterleaks for the past three months. It's the successor to Gitleaks since I'm not focused on that project much anymore. I just released v1.2.0 which added GitHub as a source to scan for secrets against and a new filtering system powered by CEL for more expressiveness.
8 years ago I wrote the first lines of Gitleaks and have been hooked on finding leaked secrets since. Gitleaks grew from a small project to a name recognized by developers and security folks. It sucks but I gotta take a step back from the project. I'll cut security releases but don't expect any new features from me. But I'm not stepping back from secrets scanning! I'm working full time on maintaining Betterleaks, a drop-in replacement for Gitleaks with some fun new features and improvements like rule-defined validation, faster scans, new filters like token efficiency, and more.
Happy to chat about it and sorry if this causes any migration headache
`alias gitleaks='betterleaks'` should do the trick
looks familiar
gitleaks : fatal error: runtime: out of memory
Should be fixed now: https://github.com/gitleaks/gitleaks/pull/1292. Thanks for highlighting this simple change I've been putting off :)
Agreed! 1/1000 is pretty frequent considering how many pushes to GitHub happen every single day. Folks probably get a false sense of security thinking no one is looking at their personal repos (spoiler alert... they are!)
Gitleaks also offers a nice pre-commit hook: https://github.com/zricethezav/gitleaks#pre-commit
Good reminder to run Gitleaks or Gitleaks-Action on your repos
If using GitHub-Actions, Gitleaks offers competitive pricing for a secret scanning solution.
I'm doing something similar with gitleaks: https://gitleaks.io/support.html
So far it's working out great.
I recently tried my hand in commercializing my open source project, gitleaks (http://gitleaks.io). I'm keeping the core gitleaks project MIT but changed the gitleaks-action on GitHub to a commercial license. Revenue from the commercial license and maintenance agreements has netted me much more than donations I've received over the past couple years. I encourage any open source maintainer to try and find a business model (plugin, dual license, enterprise support, etc) for their project.
FWIW, here is a blog post explaining the rationale behind starting an LLC https://blog.gitleaks.io/gitleaks-llc-announcement-d7d06a52e...
Good reminder to run https://gitleaks.io on your projects
hardcoded creds in example documentation... T_T
Use vault, env vars, GitHub/GitLab secrets, anything but string literals!!!
`pass` by itself might introduce false positives. `passwd` and `password` are common and more likely to be in the ROI of a secret. That said, I'm not opposed to `pass` by itself. I'll have to think about this one...
but I assume they were chosen based on the statistics?
Nope, not statistics. Identifiers and keywords are chosen based on what I see out in the wild being a software engineer.
More and more providers have been adding unique prefixes to their tokens and access keys which makes detection much easier. Ex, GitLab adds `glpat-` to their PAT.
A project I maintain, Gitleaks, can easily detect "unique" secrets and does a pretty good job at detecting "generic" secrets too. In this case, the generic gitleaks rule would have caught the secrets [1]. You can see the full rule definition here [2] and how the rule is constructed here [3].
[1] https://regex101.com/r/CLg9TK/1
[2] https://github.com/zricethezav/gitleaks/blob/master/config/g...
[3] https://github.com/zricethezav/gitleaks/blob/master/cmd/gene...
Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the gitleaks' generic rule [2]
[1] https://regex101.com/r/CLg9TK/1
[2] https://github.com/zricethezav/gitleaks/blob/master/config/g...
monodraw - https://monodraw.helftone.com/ like paint but for ascii art
I used it to come up with the new gitleaks logo: https://github.com/zricethezav/gitleaks
Speaking of credentials, you can use https://github.com/zricethezav/gitleaks to check if your repos contain any secrets
I made a similar tool https://github.com/zricethezav/gitleaks Reasons why you might want to use gitleaks over this:
* performance (powered by go-git)
* scan github orgs/users
* ref targeting
Lever link doesn't work
Nice, I was thinking about building something like this but was turned off by the potential legal ramifications. How is this legal? Is this within fair use of the original author of the article?