How Source Code is Revealing our Secrets
summary
Claims large-scale measurement: over 6 million secrets found on public GitHub, about three commits with secrets per 1,000, private repos are four times likelier to leak, and a 10,000-image Docker Hub sample shows ~5% of images exposing secrets. Describes tooling and workflow: GGShield CLI and server or on‑prem deployments, layered detection including pre-commit hooks and historical git scanning. Demo shows local hook blocks commits and CI checks fail until keys are removed and rotated.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:38What are secrets in software development?
- 3:35Example - Uber's engineering environment
- 10:39Let's focus on Cloud Services Providers' leaked keys
- 15:19Incidents detected on public repositories are only the tip of the iceberg!
- 17:39GitHub and internal git repositories are not the only place where secrets are hardcoded
- 19:31Secrets must not be exposed in the SDLC
- 21:54Automate secrets detection to reduce their risks of exposure
- 22:55Challenges with automated secrets detection
- 24:06Hardcoded secrets are not a runtime vulnerability
- 25:23Continuously scan incremental code changes at every stage of the SDLC
related talks
33mGaining initial access by exploiting leaked credentials
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
14mStop Committing Your Secrets - Git Hooks To The Rescue!
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
30mBelow the Radar: Identifying Hidden Threats Within the Development Ecosystem
24mHow to Find if Your Developers are Leaking Secrets?
15mStop Committing Your Secrets - Git Hooks To The Rescue!