I Ran 4 Secret Scanners on the Same File. The Smallest One Found the Least — and I Still Use It Daily

Описание и применение

Разработчик внедрил многослойную стратегию обнаружения секретов: быстрый сканер dotguard для pre‑push, gitleaks в CI для истории, TruffleHog для проверки живых ключей и встроенное сканирование GitHub для защиты от push‑ов.

Задача

A developer needed a quick, reliable way to detect secrets in environment files before committing, without lengthy setup or false positives.

Результат

The developer now uses dotguard for quick pre‑push checks, gitleaks in CI for history scanning, TruffleHog for incident response verification, and GitHub secret scanning for platform safety. This layered approach balances speed, coverage, and reliability.

Рабочий процесс

• Create a test secrets.env file with seven fake secrets.
• Run dotguard via npx to quickly scan the current file.
• Run gitleaks with --no-git to detect secrets in the current commit and history.
• Optionally run TruffleHog for live‑secret verification during incident response.
• Configure GitHub secret scanning for automatic push protection.
• Set up a pre‑push git hook to run dotguard automatically.
• Add gitleaks to CI pipeline to fail on new findings.
• Use TruffleHog in incident response to verify detected secrets.
• Leverage GitHub secret scanning for platform‑level safety net.

Доказательства

dotguard is a single-file Node script. No Go binary, no Docker image, no config file to learn.

Источник

gitleaks flags all seven lines — the AWS pair, the OpenAI key, and the Stripe key that dotguard missed — and does it in a couple of seconds.

Источник

TruffleHog tries to verify candidates by actually calling the provider's APIs and checking whether the credential works.

Источник