awslabs / git-secrets

Prevents you from committing secrets and credentials into git repositories
Apache License 2.0
12.31k stars 1.16k forks source link

Support for Stripe API keys? #178

Open wpcarro opened 4 years ago

wpcarro commented 4 years ago

Stripe has API keys that look like:

>>> 'sk_live_' + ''.join(random.choice(string.ascii_letters) for _ in range(99))
'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'
>>> 'sk_test_' + ''.join(random.choice(string.ascii_letters) for _ in range(99))
'sk_test_TXdHxxfRPIoXiKHRzTSDeJeIXTMhqJbSEhqzIxwIrhYMrRpOaKaCtKxlFWLIcQQvErEOyAULUncklegZUViHWQGorpmcOnBOITC'
>>> 'pk_test_' + ''.join(random.choice(string.ascii_letters) for _ in range(99))
'pk_test_PTUMGUyCetvhIHUKHQckarIqKphkQBNKztuQenTlhEZXzXFRhBtQdiVLjOnESmdLXJCyaKjBnluqTIRNdmCKttYZCxLeUiesbxv'
>>> 'pk_live_' + ''.join(random.choice(string.ascii_letters) for _ in range(99))
'pk_live_PnFOLGGtQOIIWcLXTdKvVmuAjkxhwOcrBIdWgPkfqyKfpYRUPpfjJzweKzfqMEjWUdVfsbKnNmvjDkLrkWxXRMHCXMJPzTOyQnB'

After calling git-secrets --install and committing code that I think git-secrets should detect, I haven't been able to trigger a failed hook. Here are my hooks:

11:12:08 λ fd . | xargs rg 'git secrets'
commit-msg
2:git secrets --commit_msg_hook -- "$@"

pre-commit
3:git secrets --pre_commit_hook -- "$@"

prepare-commit-msg
3:git secrets --prepare_commit_hook -- "$@"

Is this user error? Can anyone reproduce this?

CubeOfCheese commented 3 years ago

By default git-secrets doesn't detect anything. You have to specify regex patterns for git-secrets to look for. This is done using the git secretes --add 'your regex pattern here' command.

sparr commented 1 year ago

Along with #194 we might add a prepopulated list of patterns from services like this. Can you describe this sort of key with a regex? Perhaps sk_live_[a-zA-Z]{50,} if 50 is the shortest valid length for the random part of such a key?