Intermediate LevelWeb Security & Cyber Defense
How do Git secret scanners (GitGuardian, GitHub Secret Scanning) detect leaked API keys?
❓ Interview Prompt: Explain API key exposure, Git secret scanning algorithms, Shannon Entropy detection, regex signatures, and pre-commit hooks.
Accidentally committing secret API keys or private database passwords to public Git repositories is a top breach vector:
How Secret Scanners Work:
1
Regex Signatures: Matches known vendor key prefixes (e.g. 'sk_live_' for Stripe, 'AKIA...' for AWS).
2
Shannon Entropy Analysis: Measures character randomness in strings. High-entropy random strings trigger alerts.
3
Pre-Commit Hooks: Tools like 'gitleaks' or 'trufflehog' block Git commits locally before pushing to remote repositories!
Code Implementation Example
bash
# Scan repository for leaked secrets using Gitleaks CLI:
gitleaks detect --source . --verbose💡Scanning Git repository commits for secret keys using Gitleaks CLI.
🎯 Interview Key Takeaway
Use pre-commit hooks and Git secret scanning tools like Gitleaks to catch committed API keys before code reaches remote repositories.
#Secret Scanning#Gitleaks#Git Security#Intermediate
Back to all Web Security & Cyber Defense Questions→