Skip to content

Create a SAST analyzer to detect secrets in repositories

Problem to solve

Users may unintentionally commit sensitive information to their repositories. This can include passwords, credentials for cloud providers, or SSH private keys.

If repositories are publicly accessible, or even if they are private but shared within many users, the secrets can be leaked to people that should not have access to those credentials.

Once on the repo, it is too late to block someone to find them. Git commits cannot be deleted. But GitLab can notify users that secrets have been compromised, so at least they can revoke/change/suspend the leaked credentials and mitigate the impact.

Target audience

Proposal

Create a new analyzer for the SAST tool to provide secret detection.

This analyzer will be executed every time, to it reports true to compatibility checks with the repository. As part of SAST, it will be part of the sast job definition, and Auto DevOps pipelines.

The vulnerability text should be clear enough to help users in fixing the problem.

The tool should provide scanning for the last version of the repo (or last commit) to save time on big repos.

We can evaluate different existing open source tools:

Tasks

What is the type of buyer?

Executive

Edited by Gilbert Roulot