Detect secrets like API keys in using simple Python script

Secrets like API keys, credentials and security certificates are the crown jewels of organizations but can easily sprawl through all your systems. It is important to be able to gain visibility into your systems and code to find these secrets. In this tutorial, we will run through a simple python script to scan for secrets in local files and directories. The same principles can be applied to detect secrets anywhere in your CI/CD pipeline.

Links:

Open-source dependencies:

[MichaelBushey]

TruffleHog is a superior solution to this - it can run in docker or in local k8s github runner with a simple actions step. No sending company code off to some random company.

[chevalieras]

Environment variables are not a recommended idea to store secrets, there are many cases of compromises caused by server errors spitting all env variables in the stack trace and leaking secret keys and creds.
Thanks for the video, but I am puzzled why is there a full *PAID* product around what 52 lines of code (see truffleHog) can do.

[ArthurPieri]

So basically I am sending loads of information to a third party API?