trufflehogを活用ã—ãŸGitHub Organizationã®credentialsスã‚ャン - 10X Product Blogã“ã‚“ã«ã¡ã¯ã€ã‚»ã‚ュリティãƒãƒ¼ãƒ ã®@sota1235ã§ã™ã€‚ çªç„¶ã§ã™ãŒã€ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®çš†ã•ã‚“ã«è³ªå•ã§ã™ã€‚他者ã«æ¼ã‚‰ã—ã¦ã¯ã„ã‘ãªã„API keyã‚„SSHã®private keyを誤ã£ã¦GitHubã«pushã—ã¦ã—ã¾ã£ãŸã“ã¨ã¯ã‚ã‚Šã¾ã™ã‹ï¼Ÿç§ã¯ã‚ã‚Šã¾ã™ã€‚*1 日々ã€ã‚¹ãƒ”ード感をæŒã£ã¦ã‚‚ã®ã¥ãã‚Šã«è‡¨ã‚“ã§ã„ãä¸ã§æœ¬å½“ã¯commitã—ã¦ã¯ã„ã‘ãªã„ã‚‚ã®ã‚’é–“é•ã£ã¦commitã—ãŸã‚Šã€ãã‚Œã«æ°—ã¥ã‹ãšã«GitHubã«pushã—ã¦ã—ã¾ã†ãªã‚“ã¦ã“ã¨ã¯äººé–“ãŒãƒŸã‚¹ã‚’ã™ã‚‹ç”Ÿã物ã§ã‚る以上ã€èª°ã«ã§ã‚‚èµ·ããˆã‚‹äº‹æ•…ã§ã™ã€‚ 今回ã¯ãã‚“ãªäº‹æ•…を検知ã™ã‚‹ã®ã«trufflehogを活用ã—ã¦ã„ã‚‹ãŠè©±ã‚’ã—ã¾ã™ã€‚ ãªãŠä»Šå›žã¯äº‹æ•…を未然ã«äºˆé˜²ã™ã‚‹è©±ã«ã¯è§¦ã‚Œã¾ã›ã‚“。 github.com credentialsを誤ã£ã¦GitHubã«pushã™ã‚‹ã“ã¨ã®ãƒªã‚¹ã‚¯ credentialsã¨ã¯ credentialsã®ã‚ã‚‹ã¹ã管ç†æ–¹æ³• GitH
trufflehog x pre-commit & GitHub Actions 㧠GitHubã®ã‚»ã‚ュリティを強化ã—ãŸã£ã¦ã°ã‚ˆ - ABEJA Tech Blog
GitHub - newrelic/rusty-hog: A suite of secret scanners built in Rust for performance. Based on TruffleHog (https://github.com/dxa4481/truffleHog) which is written in Python.
SecurityTrails | Top GitHub Dorks and Tools Used to Scan GitHub Repositories for Sensitive Data
GitHub - trufflesecurity/trufflehog: Find, verify, and analyze leaked credentials
truffleHogRegexes/truffleHogRegexes/regexes.json at master · dxa4481/truffleHogRegexes
{{#tags}}- {{label}}
{{/tags}}