Viewing profile — zricethezav

I've been working on Betterleaks for the past three months. It's the successor to Gitleaks since I'm not focused on that project much anymore. I just released v1.2.0 which added Gi…

8 years ago I wrote the first lines of Gitleaks and have been hooked on finding leaked secrets since. Gitleaks grew from a small project to a name recognized by developers and secu…

looks familiar

> gitleaks : fatal error: runtime: out of memory Should be fixed now: https://github.com/gitleaks/gitleaks/pull/1292 . Thanks for highlighting this simple change I've been putting …

Agreed! 1/1000 is pretty frequent considering how many pushes to GitHub happen every single day. Folks probably get a false sense of security thinking no one is looking at their pe…

Gitleaks also offers a nice pre-commit hook: https://github.com/zricethezav/gitleaks#pre-commit

Good reminder to run Gitleaks or Gitleaks-Action on your repos - https://github.com/zricethezav/gitleaks - https://gitleaks.io/products

If using GitHub-Actions, Gitleaks offers competitive pricing for a secret scanning solution. https://gitleaks.io/products

I'm doing something similar with gitleaks: https://gitleaks.io/support.html So far it's working out great.

I recently tried my hand in commercializing my open source project, gitleaks ( http://gitleaks.io ). I'm keeping the core gitleaks project MIT but changed the gitleaks-action on Gi…

Good reminder to run https://gitleaks.io on your projects

hardcoded creds in example documentation... T_T Use vault, env vars, GitHub/GitLab secrets, anything but string literals!!!

`pass` by itself might introduce false positives. `passwd` and `password` are common and more likely to be in the ROI of a secret. That said, I'm not opposed to `pass` by itself. I…

More and more providers have been adding unique prefixes to their tokens and access keys which makes detection much easier. Ex, GitLab adds `glpat-` to their PAT. A project I maint…

Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop …

monodraw - https://monodraw.helftone.com/ like paint but for ascii art I used it to come up with the new gitleaks logo: https://github.com/zricethezav/gitleaks

Speaking of credentials, you can use https://github.com/zricethezav/gitleaks to check if your repos contain any secrets

I made a similar tool https://github.com/zricethezav/gitleaks Reasons why you might want to use gitleaks over this: * performance (powered by go-git) * scan github orgs/users * ref…