Rollout Your Hardcoded Secrets Detection With Min Effort & Max Impact!
summary
Concrete reference implementation available and tested rather than high-level platitudes: an trufflehog scanner wired into a Terraform + Python backend, ingestion into Postgres via SQLAlchemy/Alembic, and a GitHub App + AWS Lambdas pipeline for scheduled and ongoing scans. Findings land in a database, create issues or PR comments, and can temporarily make public repos private; detector verification runs before noisy alerts. Rotation is deliberately manual and verification can hit live services, so expect operational caveats and clear docs plus an OSS repo to try.
AI-written summary · about
chapters (9)
- 0:00Secrets detection challenges
- 3:17Secrets detection importance
- 10:00Detection challenges at scale
- 17:48Successful detection program
- 21:00Automated solution architecture
- 27:48Backend and ingestion pipeline
- 31:36Ongoing scans and developer integration
- 34:45CLI to full rollout benefits
- 38:38Q&A
related talks
39mSecurity in a DevOps World
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
35mGit those secrets out your repos!
45mWrongSecrets: We Have a Secret for Everyone!
34mWho Goes There? Detecting Intruders With Honeytokens
31mFighting Secrets In Source Code With TruffleHog
26mSecret Hunting
26mSecurity Automation For GraphQL