Harvesting Secrets from Code Repos

• accidentally committing secrets to public repos
• https://github.com/search?q=+++"type":"service_account",AND+++"private_key":+"-----BEGIN+PRIVATE+KEY-----\n&type=code&p=1
• ![[Attachments/Pasted image 20260305143913.png]]

---

TruffleHog

• https://github.com/trufflesecurity/trufflehog
• secrets discovery, classification, validation and analysis tool
  • checks across git, chats, wikis, logs, API testing platforms, object stores, filesystems, more
• scenario:
  • examine https://github.com/Gigantic-Retail/shopping-cart
• ![[Attachments/Pasted image 20260305150122.png]]
  • found HMAC keys
  • these can only be used with gsutil and not gcloud
• unset the config passed from gcloud
• gsutil config -a
• gsutil ls -r gs://giganticretail-logs