Final check on redacting API keys/secrets/passwords and personally identifiable information

[heidimok]

Part of https://github.com/NASA-IMPACT/admg-backend/issues/518 @EJwalker13 has already skimmed through the repo to make sure there wasn't personally-identifiable information currently in the repo (none) when filling out the SRS package but it would definitely be best to use a security tool as a final check.

This issue is to do that final check using a tool.

[heidimok]

@edkeeble Do you have any tips on a specific tool to check both of these? Eli could run it and which would put us in a good place for security.

[edkeeble]

https://github.com/awslabs/git-secrets will scan the repo for text that looks like secrets, passwords, etc. You'll want to run it with git secrets --scan-history to make sure you're checking every commit in the entire history of the repo. It won't scan for PII. There are tools out there that can scan for PII, but they mostly seem to be services which require you to grant access to the github repo (not ideal for a security tool!). Honestly, PII is much less likely to be present int the repo than access keys, etc, so I'd probably just start with git-secrets.

[EJwalker13]

Security Check Results