secret checker

[nissessenap]

Could something like gitleaks be useful as part of our default CI pipeline for checking for passwords being commited in git.
There are probably other tools but gitleaks looks a solid option at least.

https://github.com/zricethezav/gitleaks
https://github.com/zricethezav/gitleaks-action

[nissessenap]

Another option seems to be:
https://github.com/trufflesecurity/truffleHog
https://github.com/marketplace/actions/trufflehog-oss

There are probably a bunch more

[simongottschlag]

Doesn't Horusec support this already?

[nissessenap]

Haven't checked, not impossible. But these are putposed built tools, so unless horusec uses them one of these are probably a better option

[simongottschlag]

I think they have their own and integrates GitLeaks as well by default.