search

Yelp / detect-secrets

An enterprise friendly way of detecting and preventing secrets in code.
Apache License 2.0
3.62k stars 450 forks source link

How to show the raw plain text secret detected by detect-secrets? #680

Open setu1421 opened 1 year ago

setu1421 commented 1 year ago

I want to retrieve the exact matched string from hashed secret provided by the tool. So, I ran the detect-secrets tool for willymcallister/spinningnumbers repository and a sample output of the tool is shown below:

image

The tool has found a private key in line 184 of _articles/staticman-heroku.md file.

image

However, I tried to compute the hashed secret using hashlib with different combinations of the secrets such as by removing unnecessary texts. But I could not compute the exact hashed secret provided by the tool.

image

Which part of the actual secret string has been used to calculate the hashed secret? Or Is there any way to get the plain text secret instead of hashed secret in the report using any flag? Please let me know your feedback.

geekNero commented 1 year ago

Hey, you can go into the library and remove a line in detect_secrets/core /potential_secret.py at line number 56 , and insert this: self.secret_hash: str = secret