Why doesn't git secrets find my committed secrets?
- Dominant language
- Shell
- Stars
- 13.4k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Description
So I recently added a SECRET to our repo by accident. To prevent this from happening in the future I found this repo. I installed it and I tested it but it doesn't seem to work at all.
The password I committed is in the `README.md` and was formed as follows:
export OURCOMPANYNAME_OBJECTSTORE_PASSWORD=16_character_random_string
I tried using the following commands from the root of the repo (the `README.md` is also in the root dir of the repo):
```
$ git secrets --scan -r
$ git secrets --scan README.md
$ git secrets --scan --scan-history
$ git secrets --scan --scan-history -r
$ git secrets --scan --scan-history -r .
$ git secrets --scan README.md
$ git secrets --scan -r .
$ git secrets --scan -r ./*
```
All these tries gave no output at all. The string even includes the word `PASSWORD` in there so I presumed that would be the simplest thing to find.
Am I doing something wrong? Am I misunderstanding what this project should be doing? Or is this some kind of extremely rare exception that it can't find it?
All tips are welcome!
Contributor guide
Research direction
The payload names only README.md and the listed git secrets --scan command variants; reproduce the report from the repository root with those commands first. Then trace the configured scan behavior and document whether the reported line should match; done means a clear explanation or a verified fix, with coverage for this reproduction if code changes are needed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, shell
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100