fix(scan-secrets): portable single-quote class + hyphenated key detection#4
Conversation
…tion
Two macOS (BSD grep) gaps in scan-secrets.sh let real secrets through:
1. \x27 is not interpreted as a single-quote by BSD grep, so the char
classes ["\x27] degraded to a literal set {" \ x 2 7}. Single-quoted
credentials (password = 'value') slipped past, and double-quoted values
containing 2/7 were truncated below the length threshold. Replaced with
the portable '\'' form yielding the class ["'].
2. sk-[a-zA-Z0-9]{20,} broke at the first hyphen, so modern Anthropic keys
(sk-ant-api03-...) were never matched. Allowed hyphens in the class.
Adds 10 scan-secrets fixtures (hook previously had no test coverage).
Full suite: 46 passed, 0 failed.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| - | - | GitHub Personal Access Token | 7e52a9c | hooks/tests/fixtures/scan-secrets/07-block-github-token.json | View secret |
| - | - | PostgreSQL Credentials | 7e52a9c | hooks/tests/fixtures/scan-secrets/09-block-conn-string-creds.json | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
Nice fix — reproduced both bugs locally. Before merge, could you run bash scripts/sync-plugins.sh and commit the result? Otherwise the vendored copy under plugins/setupdotclaude/template/hooks/ keeps the buggy version. Should be just the regenerated scan-secrets.sh plus the new fixtures dir. Thanks! |
2 participants
Summary
hooks/scan-secrets.shhad two gaps on macOS (BSD grep) that let real secrets through. Found while installing and live-testing the kit on macOS (BSD grep 2.6.0-FreeBSD).Bug 1 —
\x27not portable (HIGH, macOS-only)BSD grep does not interpret
\x27as a single-quote, so the char classes["\x27]/[^"\x27]degraded to a literal set{" \ x 2 7}.Consequences on macOS:
password = 'supersecretvalue'→ allowed.2or7were truncated below the 8-char threshold (e.g."hunter2hunter2"matched onlyhunter).Fix: replace
\x27with the portable'\''shell idiom, yielding the class["']. Works on both BSD and GNU grep.Bug 2 — hyphenated keys missed (MEDIUM, cross-platform)
sk-[a-zA-Z0-9]{20,}stops at the first hyphen, so modern Anthropic keys (sk-ant-api03-...) were never matched. OpenAI-stylesk-proj...(no hyphen) worked. Fix: allow hyphens —sk-[a-zA-Z0-9-]{20,}.Tests
scan-secrets.shpreviously had no fixtures. Added 10 covering: clean source,process.envreference (no false positive), double- and single-quoted credentials, hyphenatedsk-antkey, AWS access key, GitHub PAT, private-key block, connection string with creds, and non-Edit/Write tool ignore.Before → after (live repro on macOS):
password = 'supersecretvalue'sk-ant-api03-...const apiKey = process.env.API_KEYNo behavior change on Linux/GNU grep beyond the hyphen fix; this aligns macOS behavior with it.