Investigate options for more thorough secret scanning
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 48
- Forks
- 36
- Avg merge
- 2m
- Merged PRs (30d)
- 3
Description
GitHub already scans for and automatically revokes API tokens that get pushed to repositories. However, GHSA-67f2-674w-6g63 involved a GitHub PAT in an unencrypted Base64‐in‐YAML Kubernetes Secret file format leaked in a Codeberg repository, which went undetected.
I don’t know what the options here look like, but names I’ve seen mentioned include GitGuardian (SaaS), TruffleHog, and Gitleaks. I don’t know if any of those would be able to scan public repositories across different hosts, but it seems worth investigating. Possibly this is something that might require coordination across repository hosts.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing GitGuardian, TruffleHog, and Gitleaks against the reported GitHub PAT leak in a Base64-in-YAML Kubernetes Secret. Investigate whether any option can scan public repositories across GitHub, Codeberg, and other hosts, and document a viable approach or the coordination required between repository hosts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, kubernetes
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100