Security Scan

Scan Process

1. File-Level Scan

Search for sensitive patterns across the codebase:

# Search for common secret patterns
rg -n "(token|api[_-]?key|secret|password|passwd|private[_-]?key|credential)" --glob "!node_modules" --glob "!.git" --glob "!*.lock"

2. Git History Scan

Check if secrets were ever committed:

# Search git history for secrets
git log -p --all -S "token" -- "*.json" "*.env" "*.config.*" "*.yml" "*.yaml"

3. Config File Audit

Identify config files that should be gitignored:

# Find config files that might contain secrets
rg --files | rg -i "(\.env|config|secret|credential|\.json|\.yaml|\.yml)" | rg -v "node_modules|\.git|dist|build"

4. .gitignore Verification

Ensure sensitive files are excluded:

# Check if .gitignore covers common secret patterns
cat .gitignore | rg -i "(\.env|secret|credential|token|key|password|\.json)"

Common Patterns to Flag

❌ Hardcoded Credentials

// BAD
const token = "ghp_xxxxxxxxxxxxxxxxxxxx";
const config = { password: "real_password_123" };

❌ Real Values in Examples/Docs

// BAD
{
  "baseUrl": "http://real-server.com",
  "token": "ee96b34d7f52d9f0863e7bcb0994464a05b5070d"
}

✅ Safe Patterns

// GOOD
{
  "baseUrl": "http://example.com",
  "token": "your-token-here"
}

// GOOD - read from environment
const token = process.env.GITHUB_TOKEN;

Remediation

When secrets are found:

1. Rotate immediately - Assume the secret is compromised
2. Remove from code - Replace with placeholder or env var reference
3. Add to .gitignore - Prevent future commits
4. Use secrets manager - For production, use vault/secret manager

Quick Reference

Common Mistakes

• Scanning only current files - Secrets may be in git history
• Ignoring documentation - README/docs often contain real tokens
• Not rotating found secrets - Finding a leaked token means it's compromised
• Trusting .gitignore alone - Already-committed secrets remain in history
• Using "example" values that are real - [email protected] may be real

Red Flags

• Any 40+ character hex string in code
• Base64-encoded strings that decode to credentials
• URLs with embedded credentials (http://user:pass@host)
• Files named .env, *secret*, *credential* not in .gitignore
• Email addresses that look personal (not test@, user@, example@)