Building Dotguard: What Writing Detection Rules Taught Me About Developer Habits

说明与用途

dotguard 是一个单文件、无依赖的秘密扫描器，可通过一行 GitHub Actions 步骤集成到 CI。它检测真实秘密模式，管理误报，并鼓励旋转，使检测成为团队习惯。

问题

Teams often miss or mishandle secrets, leading to costly leaks. Existing scanners either lack trust, generate false positives, or are hard to integrate into CI.

结果

dotguard enabled teams to detect secrets quickly, reduce false positives, and enforce rotation through a simple CI step, turning secret management into a repeatable habit.

工作流

• 1. Add dotguard to the repository as a single file. 2. Commit a pre‑push or CI step that runs npx @wuchunjie/dotguard --report. 3. On each push, the scanner outputs a JSON report of findings. 4. Review the report: file, line, rule, severity. 5. Verify each finding; if real, rotate the key. 6. Update the suppression list for known false positives. 7. Re‑run the scan to confirm rotation and absence of the old key.

证据

The scanner looks for the patterns that real secrets actually take… It also checks for high‑entropy strings assigned to suspicious variable names…

来源

The entire CI integration is one step: a run line that invokes the scanner via npx… Every push gets a full scan, and the build fails if a secret is found…

来源