This repository implements automated secret scanning to prevent accidental credential commits.

1. Pre-commit Hook (Local) - Optional local validation on your machine
2. GitHub Actions (Required) - Automated server-side checks on all commits
3. TruffleHog Scanner - Detects API keys, tokens, passwords, and other credentials

Install TruffleHog locally to catch secrets before pushing:

# Install TruffleHog
pip install trufflehog

# Enable the pre-commit hook (make it executable)
chmod +x .git/hooks/pre-commit

Now, any commit with secrets will be blocked locally before reaching the server.

If you prefer manual scanning:

# Scan current uncommitted changes
trufflehog filesystem .

# Scan specific file
trufflehog filesystem path/to/file

Act immediately — exposed credentials pose security risks.

Check the failed workflow run to see which patterns matched.

• Change API keys, tokens, and passwords immediately
• Update services that use the exposed credential
• Monitor for unauthorized access

Use git filter-branch or git rebase to remove the secret:

# Option A: Rebase to remove the commit (if not yet pushed to main)
git rebase -i HEAD~N  # N = number of commits to rebase

# Option B: Use git filter-branch for complex scenarios
git filter-branch --tree-filter 'rm -f path/to/secret-file' HEAD

git push -f origin your-branch

TruffleHog detects patterns for:

• AWS credentials
• Private keys (RSA, DSA, EC, PGP)
• Database credentials
• API tokens and keys
• OAuth tokens
• Slack tokens
• GitHub tokens
• And many more...

If TruffleHog flags something that isn't actually a secret:

1. Use truffleHog directly to verify
2. Document the false positive in a comment
3. Contact the security team if you need an exception

Never commit .env files containing actual secrets.

# ✅ Good: Use .env.example with placeholder values
DB_PASSWORD=your_password_here
API_KEY=your_api_key_here

# ✅ Good: Add to .gitignore
echo ".env" >> .gitignore

# ❌ Wrong: Never commit actual credentials
# .env files with real values should always be in .gitignore

• TruffleHog Documentation
• OWASP: Sensitive Data Exposure
• Git Credential Management

If you encounter false positives or have questions, open an issue or contact the security team.

Last Updated: June 2026