Azhar's Notes

Secrets Scanning & Repo Security Pipeline — Gitleaks, truffleHog, Pre-commit Hooks, Secret Rotation Playbook

6 menit baca

Ringkasan

Secrets scanning adalah proses mendeteksi credential, token, API key, dan informasi sensitif lain yang secara tidak sengaja ter-commit ke repository Git. Dampak kebocoran secrets sangat serius — dari account takeover hingga data breach. Catatan ini mencakup perbandingan tools scanning (Gitleaks, truffleHog, detect-secrets, ggshield), integrasi pre-commit hooks, CI/CD gate, serta incident response playbook untuk leaked secrets.

Domain Terkait: devsecops-pipeline-sast-dast-sbom (CI/CD security) → cicd-shiftleft-shiftright (shift-left) → cicd-guide (pipeline) → incident-response-framework (respon) → software-supply-chain-security-deepdive (supply chain) → dependency-confusion-supply-chain-attacks-praktik (dependency)

Daftar Isi

1. Mengapa Secrets Scanning Penting

Dampak Kebocoran Secrets

IncidentDampakYear
AWS keys di GitHub public repo$500K+ bill untuk mining crypto2022
Slack token leaked via .envFull channel access2023
GitHub OAuth token di commitSource code exfil2024
OpenAI API key di pastebin$100K+ usage dalam 3 jam2024

Statistik

  • > 50% dari organisasi mengalami leaked secrets setidaknya 1×
  • ~1M secrets baru terdeteksi di GitHub public per tahun
  • Rata-rata deteksi setelah leak: 47 hari (dengan scanning otomatis: < 1 jam)

Attack Vector

Developer commit .env → GitHub → Attacker scrape commit → Key aktif → Abuse API
        ↑                                ↑
    Waktu: +30 menit              Waktu: +5 menit (scanner otomatis)

2. Perbandingan Tools

ToolBahasaGit HistoryRegexEntropyMLCI/CD
GitleaksGo✅ Full✅ Ya✅ Ya❌✅ GitHub Actions, GitLab CI
truffleHogPython✅ Full✅ Ya✅ Ya✅ (v3+)✅ GitHub Action
detect-secretsPython⚠️ Diffs only✅ Ya✅ Ya❌✅ (plugin)
ggshield (GitGuardian)Python✅ Full✅ Ya✅ Ya✅ Cloud✅
SecretScanner (Deepfence)Go✅ Full✅ Ya✅ Ya❌❌ Standalone
GitLeaks EnterpriseSaaS✅ FullCustomAI✅✅

Rekomendasi:

  • Gitleaks — tool all-rounder, cepat (Go), CI/CD ready, komunitas besar
  • truffleHog — untuk scan deep git history dengan ML-enhanced detection
  • detect-secrets — untuk pre-commit hooks ringan

3. Gitleaks — Git-Secrets Scanner

Gitleaks adalah tool scanning secrets berbasis Go — cepat, akurat, dan mudah diintegrasikan.

Instalasi

# Fedora/Ubuntu
go install github.com/gitleaks/gitleaks/v8@latest
 
# Atau binary langsung
curl -sSfL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks-linux-amd64 -o /usr/local/bin/gitleaks
chmod +x /usr/local/bin/gitleaks

Scan Dasar

# Scan repo secara rekursif
gitleaks detect --source . -v
 
# Scan branch spesifik
gitleaks detect --source . --branch main
 
# Scan git history FULL (termasuk commit lama)
gitleaks detect --source . --log-opts="--all"
 
# Output JSON untuk processing
gitleaks detect --source . --report-path secrets-report.json --report-format json

Config Custom (.gitleaks.toml)

title = "Custom Secrets Config"
extend_ignore_path = ".gitleaksignore"
 
[allowlist]
paths = [
  "node_modules/",
  "vendor/",
  "*.test.js",
  "*.spec.ts",
  "test/fixtures/"
]
 
[[rules]]
id = "myapp-custom-key"
description = "MyApp API Key"
regex = '''myapp_[a-zA-Z0-9]{32}'''
tags = ["myapp", "api-key"]
secret_group = 0

Gitleaks Ignore

# Untuk false positive, tambahkan ke .gitleaksignore
gitleaks detect --source . --report-path report.json
# Parse hash dari report → tambahkan ke .gitleaksignore
echo "abc123def456hash:path/to/file:line:rule-id" >> .gitleaksignore

4. truffleHog — Deep Git Scanning

truffleHog v3 menggunakan entropy detection + ML untuk menemukan secrets.

Instalasi

pip install truffleHog

Scan

# Scan repo lokal
trufflehog git file://. --results=verified,unverified
 
# Scan GitHub org
trufflehog github --org=MspUrbansolv --token=$GH_TOKEN
 
# Scan dengan only-verified (kurangi false positive)
trufflehog git file://. --only-verified

JSON Output

trufflehog git file://. --json > truffle-report.json

Format output:

{
  "SourceMetadata": {
    "Data": {
      "Git": {
        "commit": "abc123...",
        "file": "backend/.env",
        "email": "dev@example.com",
        "timestamp": "2026-07-01 12:00:00"
      }
    }
  },
  "SourceID": 1,
  "SourceType": "GIT",
  "SourceName": "repo-name",
  "DetectorName": "AWS Key",
  "DetectorType": 2,
  "Verified": true,
  "Raw": "AKIAIOSFODNN7EXAMPLE",
  "Redacted": "AKIAIOS******"
}

5. detect-secrets — Pre-commit Focus

detect-secrets dari Yelp adalah tool yang dirancang untuk pre-commit scanning — ringan, plugin-based.

Instalasi

pip install detect-secrets

Init Baseline

# Buat baseline (secrets yang sudah ada dianggap known)
detect-secrets scan > .secrets.baseline
 
# Audit baseline
detect-secrets audit .secrets.baseline

Pre-commit Setup

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ["--baseline", ".secrets.baseline"]
        exclude: "package-lock.json|yarn.lock|*.lock"

6. Pre-commit Hooks Setup

.pre-commit-config.yaml lengkap

repos:
  # Gitleaks
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
 
  # detect-secrets sebagai backup
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ["--baseline", ".secrets.baseline"]
        exclude: '\.(lock|min\.js|map)$'

Instalasi

pip install pre-commit
pre-commit install
pre-commit run --all-files  # Test semua file

7. CI/CD Gate Integration

GitHub Actions

# .github/workflows/secrets-scan.yml
name: Secrets Scan
on:
  push:
    branches: [main, staging, dev]
  pull_request:
    branches: [main]
 
jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history untuk scan
 
      - name: Gitleaks Scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
  trufflehog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - name: truffleHog Scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

GitLab CI

secrets-scan:
  stage: security
  script:
    - apt-get update && apt-get install -y golang
    - go install github.com/gitleaks/gitleaks/v8@latest
    - gitleaks detect --source . --report-path gl-secrets.json
  artifacts:
    paths: [gl-secrets.json]
  only:
    - main
    - staging

Block Policy

SeverityAction
Verified secret🛑 Block pipeline
Unverified high entropy⚠️ Warning + manual review
Known false positive✅ Allow (via .gitleaksignore)
Baseline secret✅ Allow (known)

8. False Positive Management

Sumber False Positive

SumberContohMitigasi
Test fixturestest/fixtures/tokens.json.gitleaksignore
DocumentationREADME.md contoh keyPath allowlist
Binary/vendornode_modules/, vendor/paths di config
Hash valuesSHA256 di commit logsEntropy threshold tuning

Entropy Threshold

# .gitleaks.toml
[entropy]
  # Default: 3.5 — naikkan untuk mengurangi FP
  # Turunkan untuk deteksi lebih agresif
  word = 4.0

9. Incident Response — Leaked Secrets

Ketika secret terdeteksi sudah terlanjur di-commit ke publik:

Playbook

1. DETECT → Gitleaks/truffleHog report
2. TRIAGE → Apakah secret masih aktif? Bisa diverifikasi?
3. CONTAIN → Revoke key sekarang juga
4. REMEDIATE → Hapus dari git history
5. VERIFY → Scan ulang untuk confirm removal
6. POST-MORTEM → Root cause, prevent recurrence

Step-by-step

Step 1: Revoke Sekarang

# AWS Key
aws iam delete-access-key --access-key-id AKIAIOSFODNN7EXAMPLE
 
# GitHub Token → Revoke via Settings → Developer Settings → Tokens
 
# Generic API Key → Login ke dashboard provider → Revoke

Step 2: Hapus dari Git History

# Opsi 1: BFG Repo-Cleaner (lebih cepat)
java -jar bfg.jar --delete-files .env repo.git
 
# Opsi 2: git filter-branch
git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch .env" \
  --prune-empty --tag-name-filter cat -- --all
 
# Opsi 3: GitGuardian — paid, comprehensive

Step 3: Force Push

git push origin --force --all
git push origin --force --tags

Step 4: Rotate

# Generate key baru
openssl rand -base64 32
# Update di semua tempat yang memakai

Step 5: Cek GitHub Secret Scanning

# GitHub sendiri sudah scan public repos secara otomatis
# Cek: https://github.com/settings/security-alerts

10. Secret Detection Regex Patterns

Secret TypePattern Example
AWS Access KeyAKIA[0-9A-Z]{16}
GitHub Tokenghp_[a-zA-Z0-9]{36}
GitLab Tokenglpat-[a-zA-Z0-9\-]{20,}
Slack Tokenxox[baprs]-[a-zA-Z0-9\-]{10,}
OpenAI API Keysk-[a-zA-Z0-9]{20,}
JWT TokeneyJ[a-zA-Z0-9\-_]+\.eyJ[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+
Generic Base64(?:[A-Za-z0-9+/]{40,}={0,2})
Private Key`-----BEGIN (RSA
Password in URLhttps://user:password@host
.env assignment[A-Z_]+=[A-Za-z0-9\-_]{8,}

11. Encrypted Secrets Storage (SOPS, age, vault)

Mozilla SOPS + age

# Generate age key
age-keygen -o ~/.config/sops/age/key.txt
 
# Encrypt .env
sops --encrypt .env > .env.enc
 
# Decrypt
sops --decrypt .env.enc > .env

Git Integration

# .sops.yaml
creation_rules:
  - path_regex: \.env\.enc
    age: <age-public-key>

HashiCorp Vault (untuk production)

# Store
vault kv put secret/myapp DB_PASSWORD=supersecret
 
# Read
vault kv get -field=DB_PASSWORD secret/myapp

12. Referensi

Cross-link vault:

Tampilan Grafik