3 ways to detect secrets in source code:
- patten matching, eg. PASSWORD="*", eg git-secrets
- entropy scores entropy(aaaaa) < entropy(V(^XBP@gF4dXw!df), eg detect-secrets
- search for *known* keys and passwords, no known lib for this
I wrote me a script for the 3rd one.
People store secrets in ad hoc, weird places. So there might not be a general solution. Anyhow, input is list of .ini files, a white list of false positives. If you know that your AWS key is AKIA1234566, then you can search for that exact string, you know it after all
♡ 3 ↻ 0