Git those secrets out your repos!
summary
Claims a repeatable workflow that finds and tracks leaked credentials across many repos, using SecretMagpie which runs git-leaks and trufflehog and emits an HTML report. A demo scan of a sample repo returns 536 secrets with 200 unique items (trufflehog finds 11 distinct matches), flags AWS keys that enabled a real crypto farm abuse, and integrates automatic ticket creation so teams can rotate immediately and audit access.
AI-written summary · about
chapters (11)
- 0:00intro
- 1:43preamble
- 2:25whoami
- 4:08whoarewe
- 4:45content
- 5:32what is the problem?
- 12:48what can go wrong?
- 18:36how do we defend?
- 27:53secretmagpie?
- 34:18questions?
- 34:32thanks
related talks
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
31mFighting Secrets In Source Code With TruffleHog
14mStop Committing Your Secrets - Git Hooks To The Rescue!
45mWrongSecrets: We Have a Secret for Everyone!
26mSecret Hunting
15mStop Committing Your Secrets - Git Hooks To The Rescue!
48mHow Source Code is Revealing our Secrets
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible