Chapter 2 of 7 · 4 practices · 3 min · 4-question quiz
Catching leaks before and after they happen
Tools that stop secrets reaching a repository, and the order of steps when one gets through.
Start: Turn on secret scanning and push protection4 practices in this chapter
- 1Turn on secret scanning and push protectionTwo GitHub features work together here, and you want both on. Scanning tells you after the fact; push protection stops the leak in the first place.
- 2Scan for secrets locally and in CINo single scanner catches everything, so OWASP recommends scanning at two levels: at the developer level (editor or pre-commit hook) and again in CI. Each layer catches what the other misses. Free…
- 3When a secret leaks, revoke and rotate it before cleaning historyGitHub's guidance is to revoke or rotate an exposed credential immediately. Bots scan public commits for keys continuously, so assume it has been seen. Rewriting git history is slow, often…
- 4Keep secrets out of URLs, tickets, screenshots and AI chatsSecrets leak through side doors as often as through git: An API key in a query string ends up in server and proxy logs; A token pasted into a bug report is visible to the whole team; A screenshot of…
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.