logger.info(f"Don't Give all your {secrets} away")
summary
A developer-turned-researcher describes an open-source Python solution that replaces the logging formatter to mask secrets at runtime, using GitLeaks rules parsed into a prefix filter and an Aho‑Corasick automaton to choose which regexes to run. The tool masks found secrets with a fixed-length star string, enforces a per-line timeout to avoid regex DoS, and shows a measured ~16% runtime penalty in exchange for preventing accidental leaks.
AI-written summary · about
chapters (19)
- 0:00Introduction of speaker
- 0:31Real-world leak example
- 1:34Why developers love logs
- 2:15Purposes of logging
- 4:07Live code vulnerability demo
- 5:33Hidden secrets in objects
- 6:17Limitations of static scanners
- 7:23Log system access risks
- 8:09Introducing MaskLogger tool
- 8:30Live MaskLogger demo
- 9:36How MaskLogger works
- 10:42Behind the scenes details
- 13:13Aho-Corasick algorithm
- 14:18Runtime masking process
- 15:07Performance impact
- 15:52Security against DoS
- 16:34Masking secret lengths
- 17:16Key takeaways
- 18:03Q&A session
related talks
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
26mHow To Keep A Secret
23mSecurity Considerations in API Docs
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
27mCan you keep a secret?
34mThe Secret Life of Secrets
24mHow to Find if Your Developers are Leaking Secrets?
35mFollow the data to learn the secret