awslabs / awslabs/git-secrets

Why doesn't git secrets find my committed secrets?

Open
#140 1 comment 7 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
13.4k
Forks
1.3k
PR merge metrics
No merged PRs in 30d

Description

So I recently added a SECRET to our repo by accident. To prevent this from happening in the future I found this repo. I installed it and I tested it but it doesn't seem to work at all.

The password I committed is in the `README.md` and was formed as follows:

export OURCOMPANYNAME_OBJECTSTORE_PASSWORD=16_character_random_string

I tried using the following commands from the root of the repo (the `README.md` is also in the root dir of the repo):
```
$ git secrets --scan -r
$ git secrets --scan README.md
$ git secrets --scan --scan-history
$ git secrets --scan --scan-history -r
$ git secrets --scan --scan-history -r .
$ git secrets --scan README.md
$ git secrets --scan -r .
$ git secrets --scan -r ./*
```
All these tries gave no output at all. The string even includes the word `PASSWORD` in there so I presumed that would be the simplest thing to find.

Am I doing something wrong? Am I misunderstanding what this project should be doing? Or is this some kind of extremely rare exception that it can't find it?

All tips are welcome!

Contributor guide

Open the contributing guide

Research direction

The payload names only README.md and the listed git secrets --scan command variants; reproduce the report from the repository root with those commands first. Then trace the configured scan behavior and document whether the reported line should match; done means a clear explanation or a verified fix, with coverage for this reproduction if code changes are needed.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, shell
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.