mirror of
https://github.com/omegaleo/SecretSecurity.git
synced 2026-11-08 17:43:29 +00:00
97 lines
3.1 KiB
Markdown
97 lines
3.1 KiB
Markdown
# SecretSecurity
|
|
|
|
[](LICENSE)
|
|
[](https://github.com/sponsors/omegaleo)
|
|
[](https://ko-fi.com/omegaleo)
|
|
|
|
A .NET CLI tool that scans staged git changes for secrets, API keys, tokens, and sensitive credentials — and blocks commits when critical findings are detected.
|
|
|
|
## What it detects
|
|
|
|
| Type | Examples | Severity |
|
|
|------|----------|----------|
|
|
| Provider tokens | AWS access keys (`AKIA…`), Stripe live keys (`sk_live_…`), GitHub PATs (`ghp_…`), Slack tokens | Critical |
|
|
| Private keys | RSA, EC, OpenSSH private key blocks | Critical |
|
|
| Azure connection strings | `DefaultEndpointsProtocol`, `AccountKey` | Critical |
|
|
| Explicit secret assignments | `api_key=`, `token=`, `secret:` with a value | High |
|
|
| Database connection strings | General ADO.NET, Postgres/MySQL/MongoDB/Redis URLs | High |
|
|
| Suspicious blobs | High-entropy strings in suspicious context | Warning |
|
|
|
|
Dev-safe connections (localhost, 127.0.0.1, integrated security) are automatically ignored.
|
|
|
|
## Installation
|
|
|
|
Requires [.NET 10 SDK](https://dotnet.microsoft.com/download) or later.
|
|
|
|
```bash
|
|
dotnet tool install --global SecretSecurity
|
|
```
|
|
|
|
## Usage
|
|
|
|
### Install the pre-commit hook
|
|
|
|
Run once inside your repository:
|
|
|
|
```bash
|
|
secretsecurity install
|
|
```
|
|
|
|
This writes a `pre-commit` hook to `.git/hooks/` that runs `secretsecurity scan` automatically on every commit.
|
|
|
|
### Scan manually
|
|
|
|
```bash
|
|
secretsecurity scan
|
|
```
|
|
|
|
Scans all currently staged changes (`git diff --cached`). Exits with code `1` if any High or Critical findings are found, blocking the commit.
|
|
|
|
### Ignore files
|
|
|
|
Create a `.secretsecurityignore` file in your repo root with one pattern per line:
|
|
|
|
```
|
|
tests/fixtures/
|
|
mock_secrets.json
|
|
```
|
|
|
|
Any staged file whose path contains a listed pattern is skipped.
|
|
|
|
## How it works
|
|
|
|
1. Runs `git diff --cached -U0` to get only the lines you are about to commit.
|
|
2. Each added line is checked against a set of compiled regex patterns ordered by confidence.
|
|
3. Matched values are partially masked in the output (e.g. `ghp_****Ab`).
|
|
4. If any finding is High or Critical, the scan exits with code `1`, preventing the commit.
|
|
|
|
## Building from source
|
|
|
|
```bash
|
|
git clone https://github.com/omegaleo/SecretSecurity.git
|
|
cd SecretSecurity
|
|
dotnet build
|
|
dotnet run --project SecretSecurity -- scan
|
|
```
|
|
|
|
## Contributing
|
|
|
|
Contributions are welcome! To get started:
|
|
|
|
1. Fork the repository and create a branch from `main`.
|
|
2. Make your changes and ensure the project builds (`dotnet build`).
|
|
3. Open a pull request describing what you changed and why.
|
|
|
|
Please open an issue first for any significant change so we can discuss the approach before you invest time in it.
|
|
|
|
## Support
|
|
|
|
If SecretSecurity saves you from an accidental secret leak, consider supporting its development:
|
|
|
|
- [GitHub Sponsors](https://github.com/sponsors/omegaleo) — sponsor directly on GitHub
|
|
- [Ko-fi](https://ko-fi.com/omegaleo) — buy me a coffee
|
|
|
|
## License
|
|
|
|
MIT — see [LICENSE.md](LICENSE) for details.
|