TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Show HN: Sniffgit – A Python lib to find sensitive files and information in a repo

3 点作者 LHardi超过 7 年前

2 条评论

chatmasta超过 7 年前
Nice start. I notice this only scans the HEAD of the repository. Have you considered implementing functionality to go back through previous commits and check for secrets in files there? After all, once something is committed to git, even if you change the file, the old version is still there (by design, obviously).<p>For a more complex implementation of a solution to this problem, checkout trufflehog [0], which &quot;searches through git repositories for high entropy strings and secrets, digging deep into commit history.&quot;<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;dxa4481&#x2F;truffleHog" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;dxa4481&#x2F;truffleHog</a>
评论 #16121771 未加载
LHardi超过 7 年前
Hi there, I built this library after reading up some InfoSec SE posts about what sensitive files (and information) that should be gitignored or not included at all in a git repo.<p>The following article was also a motivation for me to start the project, “Dev put AWS keys on Github. Then BAD THINGS happened”: <a href="https:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2015&#x2F;01&#x2F;06&#x2F;dev_blunder_shows_github_crawling_with_keyslurping_bots&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2015&#x2F;01&#x2F;06&#x2F;dev_blunder_shows_g...</a><p>How this library works: sniffgit starts from the root of your git working directory, and check if there are any sensitive files (id_rsa, *.cert, etc) that are exposed, i.e. files that haven&#x27;t been gitignored or files that shouldn’t be in a repo at all.<p>This library also checks textfiles for sensitive information, such as AWS_SECRET_ACCESS_KEY, email, password, etc. Some files and directories are not going to be read at all, though (e.g. binary file, .git, yarn.lock).<p>Currently, the “sensitive info &#x2F; line analysis” will have a lot of false positive result for larger projects. The reason is that it only checks for keyword such as “password, API_KEY, email, etc” for each line in a text file.<p>This is my first ever open-source project. Feedbacks are truly appreciated, particularly about OSS best practices :).
评论 #16105267 未加载