Launch HN: Datree (YC W20) – Best practices and security policies on each commit

For starters, that "just" is swallowing:

- Identify the relevant tokens you want to scan for, and create regular expressions to capture them.

- Create a token alert service which accepts webhooks from GitHub that contain the token scanning message payload.

- Implement signature verification in your token alert service.

- Implement token revocation and user notification in your token alert service.

And that would replace one piece of what this does.

Hello Shimon, nice to see your post here, all the best to you and your team from an ex-colleague.

Would you mind sharing an example of a custom rule?

Not everyone uses github

Funny we built almost the same product 6 years ago (sold it to a competitor), we even did automated refactoring of Python code. We also developed a regex-like language that could operate on abstract syntax trees / annotated graphs, which we wrote all our checks with. We were working on extending that with a graph database backend and symbolic execution, basically building a large code graph that we would perform pattern matching on. We didn’t finish this work as we sold the company before that, in retrospect I often wonder what would have happened if we had kept developing it.

From my experience it’s quite hard to monetize developer tools except maybe when focusing on security, so it’s good you seem to have that as a focus as well. Good luck!

Do you offer an on-prem version for orgs that couldn't use a SaaS provider for this sort of functionality?