Major companies like Uber, Toyota, and Samsung have suffered significant breaches due to hard-coded credentials found in source code.
The number of secrets exposed in public repositories is growing faster than developer population growth, often due to hurried workflows.
Git stores a complete, compressed snapshot of files for every commit, meaning a secret committed once remains in the repository's history forever.
Relying solely on .gitignore files or vaults is insufficient because human error can lead to accidental commits, which are very difficult to remove from history.
Git hooks provide a built-in automation platform to run scripts that can scan for secrets and block commits before they are created.
Several open source tools like AWS Git Secrets, TruffleHog, and GG Shield can be used to implement pre-commit hooks for secret detection.
A practical demonstration shows how a pre-commit hook (GG Shield) detects hard-coded AWS keys and prevents the commit from completing.
The best strategy is to avoid committing secrets in the first place by using automation like Git hooks and leveraging open source tools.
Sensory-Minds GmbH
Offenbach am Main, Germany
fulfillmenttools
Köln, Germany
44:30Milecia McGregor
37:36Vandana Verma
33:20Aarno Aukia
29:34Reto Kaeser
36:33Marcel Lupo
58:52Davide Imola
29:50Kevin Lewis
58:57Alex Soto
Jobs that call for the skills explored in this talk.
Cogent Data Solutions Llc
Austin, United States of America
Gitlab's Secret Detection
Glasgow, United Kingdom
GitGuardian
Paris, France
Punk Security Ltd.