awslabs/git-secrets
Git Secrets
Git-secrets is a security utility designed to prevent the accidental exposure of sensitive credentials by integrating automated scanning directly into the version control commit lifecycle. It functions as a commit scanner that evaluates staged files and commit messages against defined security policies before changes are finalized in a repository.
The tool utilizes regular expression pattern matching to identify potential secrets and supports the registration of custom patterns to address specific organizational security requirements. To manage operational friction, it includes mechanisms for false-positive filtering through allowlists and provides options to bypass validation for specific commits when necessary.
Beyond real-time interception, the software supports retrospective security analysis by performing linear history traversals to audit entire project timelines for previously committed sensitive data. It also offers extensibility by allowing the delegation of validation logic to external scripts or binaries, enabling integration with dynamic secret checking workflows.
Features
- Commit Risk Scanning - Automatically scans staged files and commit messages to block sensitive credentials from being saved into version control.
- Git Hooks - Integrates automated security scanning directly into the version control commit lifecycle using pre-commit hooks.
- Credential Security and Utilities - Provides a utility for scanning repository history and staged files to identify and block the accidental exposure of sensitive credentials.
- Security Auditing Tools - Analyzes entire project history to identify and report previously committed secrets that may have been accidentally exposed.
- Version Control and Repository Tools - Analyzes all past revisions in a repository to identify and report any previously committed secrets.
- Pattern Matching Engines - Uses regular expression pattern matching to identify sensitive data formats within source code and commit messages.
- Security Scan Exclusions - Enables defining allowed patterns or exclusion files to ignore safe matches and prevent unnecessary blocking of legitimate code.
- Allowlist Management - Provides mechanisms to define exclusion rules that suppress false positives and permit known safe content during security scans.
- DevSecOps And Hardening - Prevents accidental commits of sensitive information to repositories.
- Static Code Analysis - Prevents accidental commits of credentials to Git repositories.
- Infrastructure Security - Prevents committing secrets to git repositories.
- Secret Detection - Prevents committing sensitive credentials to git repositories.
- Secret Management - Tool for preventing secrets from being committed to repositories.
- Secret Scanning - Prevents sensitive information from being committed to Git.
- Secrets Management - Prevents accidental commits of sensitive information by scanning git repositories.
- Secrets Scanning - Monitors commits and merge requests for patterns matching sensitive data.
- Commit History Analysis - Performs retrospective security analysis by traversing the entire project history to identify previously committed sensitive data.
- Custom Pattern Matchers - Supports registering custom regular expressions to identify and block specific types of sensitive data from being committed.
- Custom Pattern Policies - Allows defining and registering custom regular expression patterns to detect proprietary or sensitive data types.
- External Secret Resolution - Integrates with external commands or scripts to dynamically fetch and check against lists of known sensitive credentials.
- Leaked Credential Checks - Validates code against sensitive data patterns to prevent credential leaks during the development workflow.
- External Process Plugins - Supports delegating validation logic to external scripts or binaries to enable extensible and dynamic security scanning.
- Automation Security - Enforces security policies by running custom regular expression checks against code changes before they are finalized.
- Development Bypasses - Allows users to bypass secret validation for specific commits or merges to ensure legitimate code changes are not blocked.
