Secret Hunting
summary
Secrets are easy to find with free scanners like truffle hog and Chekov using regex and entropy checks, and juniors or interns routinely unearth multiple live credentials in hours. When a secret is exposed the only safe step is to rotate it immediately and not reuse the leaked value; then store the new secret in a management system accessed via CI/CD and a service account. Use separate vaults per application, pre‑commit hooks to block new leaks, and scan repo history for past exposures.
AI-written summary · about
chapters (10)
- 0:00Introduction to secrets
- 1:48Defining secrets in software
- 5:39Passwords versus secrets
- 7:08Risks and mitigation
- 9:07How to hunt for secrets
- 12:43Scanner tools and best practices
- 16:21Rotating compromised secrets
- 17:36Managing secrets securely
- 19:26Resources and community
- 21:58Q&A and final thoughts
related talks
24mHow to Find if Your Developers are Leaking Secrets?
35mGit those secrets out your repos!
26mHow To Keep A Secret
29mBehind Closed Doors: Managing Passwords in a Dangerous World
27mCan you keep a secret?
35mFollow the data to learn the secret
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
32mGuardians of the Cloud Navigating the Depths of Cloud Threat Hunting