validity checking of detected secrets ?

[Gby56]

• I'm submitting a ...
  • [ ] bug report
  • [X] feature request

Just a quick question, are there any plans to implement validity checking of detected secrets ?

[lorenzodb1]

Hi @Gby56, could you please explain what you mean by "validity checking of detected secrets"?

[Gby56]

Hi ! Something like Trufflehog's checks, most of them seem to be pure HTTP requests to use the token and see if it's still valid https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/slack/slack.go#L91

[gpflaum]

@Gby56 detect-secrets does do secret verification: https://github.com/Yelp/detect-secrets/blob/master/docs/plugins.md#Verified-Secrets Not all the plug-ins have implemented it, not as many as Trufflehog, but it wouldn't be very difficult for people to add more; the plugin framework supports it.

[lorenzodb1]

Thank you @gpflaum for helping out answering this issue :)

[Gby56]

Thank you both ! :)