Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secret Scanner is notfailing/warning on exposed Secrets. #134

Open
lucas-zimerman opened this issue Jul 10, 2024 · 3 comments
Open

Secret Scanner is notfailing/warning on exposed Secrets. #134

lucas-zimerman opened this issue Jul 10, 2024 · 3 comments

Comments

@lucas-zimerman
Copy link

Environment

Sentry Capacitor, using the latest version of Sentry Secrets on each run.

Steps to Reproduce

getsentry/sentry-capacitor#688
On this test PR, I added some secrets for testing the Secret Scanner integration, but it seems like it didn't fail nor trigger to anything (I also included the sample code used on the docs for triggering it).

Expected Result

A warning message or a failed action if secrets were found.

Actual Result

Test passed

Run if [ -e .secret_scan_ignore ]; then
🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷

2024-07-10T15:34:44Z	info-0	trufflehog	running source	{"source_manager_worker_id": "3aoRY", "with_units": true}
2024-07-10T15:34:44Z	info-0	trufflehog	scanning repo	{"source_manager_worker_id": "3aoRY", "unit": ".", "unit_kind": "dir", "repo": "https://github.com/getsentry/sentry-capacitor"}
2024-07-10T15:34:44Z	info-0	trufflehog	finished scanning	{"chunks": 737, "bytes": 2882128, "verified_secrets": 0, "unverified_secrets": 0, "scan_duration": "249.706709ms", "trufflehog_version": "3.79.0"}
@kahest
Copy link
Member

kahest commented Jul 12, 2024

@Jeffreyhung @mdtro @hubertdeng123 can you take a look please?

@mdtro
Copy link
Member

mdtro commented Jul 12, 2024

TruffleHog's support for detecting Sentry tokens isn't great. It particularly does not handle our new formats or the org auth tokens.
https://github.com/trufflesecurity/trufflehog/blob/e5f6c8d87284376abda55eb2c191be4dd141521e/pkg/detectors/sentrytoken/sentrytoken.go#L29

We're working on some contributions to Trufflehog to detect these with more confidence.

@chadwhitacre
Copy link
Member

Can we close this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants