Thinking Like a Hacker: AWS Keys in Private Repos

• gitleaks

  35 15,225 8.2 Go

  Protect and discover secrets using Gitleaks 🔑

  

It’s easy to think that it’s only important to scan for secrets in your public-facing repositories, but this real-world data breach proves that you need to treat all code the same from a security perspective. Malicious hackers can use open-source tools like Gitleaks and TruffleHog to quickly detect secrets in massive amounts of code*, without leaving a trace. As a defender, **it’s extremely important to have secret scans tightly integrated into your SDLC* (software development lifecycle) to reduce the risks of exposing them. GitGuardian offers secret scanning for private repositories in their Free, Business, and Enterprise plans.

• trufflehog

  25 13,863 9.9 Go

  Find and verify credentials

  

It’s easy to think that it’s only important to scan for secrets in your public-facing repositories, but this real-world data breach proves that you need to treat all code the same from a security perspective. Malicious hackers can use open-source tools like Gitleaks and TruffleHog to quickly detect secrets in massive amounts of code*, without leaving a trace. As a defender, **it’s extremely important to have secret scans tightly integrated into your SDLC* (software development lifecycle) to reduce the risks of exposing them. GitGuardian offers secret scanning for private repositories in their Free, Business, and Enterprise plans.

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• ggcanary

  2 125 2.3 Python

  GitGuardian Canary Tokens

  

GitGuardian has also recently introduced an open-source tool that defenders can add to their arsenal, ggcanary – the GitGuardian Canary Tokens. Security engineers should use it to plant fake AWS secrets in their internal perimeter (private repositories, CI pipelines, Jira tickets, etc.) to detect intrusion as soon as hackers attempt to exploit them.

Suggest a related project