Zach Rice

They say one tweet can change your life. Honored to be part of the uno-comma club for twitter

mood

obligatory

If you use secrets scanning tools or are curious about secrets scanning it'd mean a whole lot to me if you gave the v2 release candidate of Betterleaks a try (bonus points for opening GH issues)

github.com/betterleaks/be…

Here are some of the highlights in recent rcs

Container Scanning
----------------------
Scan images from registries, local Docker/Podman, saved archives. Scanning includes looking at historical layers, environment variables, and build history

Better JSON and XML detection
----------------------------------
I debated between building a dedicated json and xml handler to parse key value pairs, siblings, and parent child relationships, but that gets hairy quickly. So we doubled down on "regex is all you need" by expanding the generic rule (api key and passwords) to support common json and xml patterns. So we can detect things like:
```
{
"credential": {
"score": 85,
"category": "integration",
"expiry": "1d",
"value": "7c9e2a64b10f85d3e6a94720c"
}
}
```
In previous versions we don't detect this because "credential" (the keyword/identifier) is far away from the secret, "7c9e5d3e6a94720c5fb381da42e6b9f". It's not just that the secret is far away from the keyword, "credential", but rather there are other strings that would consume the capture beforehand like "integration" (there are a few other reasons we didn't detect this before, the distance is just one of them). Def need a blog post on this at some point.

Go-Git is back
----------------
Ages ago Gitleaks used go-git for scanning git histories. It was slow and unoptimized. But now, thanks to the power of AI, "I" was able to write a bunch of git plumbing in pure go w/ go-git to achieve the same (really in most cases, better) performance than shelling out `git` commands. Safer, faster, more performant. Win win.

Better Git scanning
-------------------
Reflog and unreachable-object git scanning can find credentials left behind after resets, rebases, or amended commits while those objects still exist locally. Easy as `betterleaks git . --include=unreachable-objects,reflog`

prolly a lotta secrets in there