PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Secrets Detection: A Practical Guide to Finding and Preventing Leaked Credentials

aikido.dev | blog | #git | #ci-cd | #sast | #data-breach | #credentials | #secrets-detection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Guide to secrets detection: how API keys and tokens leak through git history and CI, why SAST misses them, and how scanning commits plus blocking leaks at push time prevents breaches.
Published
Collected

Related coverage

blog · netspi.com
Next-Level DevSecOps
A GrammaTech guest post argues DevSecOps pipelines alone miss the adversarial view; pairing SAST automation with offensive security closes the blind spot where design and code flaws slip through.
incident · netlas.io
The Largest Data Breach Ever? How Hackers Stole 16 Billion Credentials
Explains how researchers found about 16 billion credentials exposed across 30+ datasets, aggregated from infostealer logs and past breaches, and what it means for account security.
blog · aikido.dev
Finding vulnerabilities at every stage: what to run, and when
Aikido maps four complementary ways to find vulnerabilities — traditional SAST, deep PR review, AI code analysis and AI pentesting — explaining what each catches and where it fits in the lifecycle.
blog · aikido.dev
And another one. GitHub ships break-glass credential revocation
GitHub shipped self-service break-glass credential revocation for Enterprise: org owners can cut off all compromised credentials—PATs, SSH keys, OAuth tokens—in one action during an active incident.
blog · aikido.dev
Introducing Aikido Expansion Packs: Safer defaults inside the IDE
Aikido Expansion Packs add opt-in security inside the IDE: a pre-commit secrets hook plus Safe Chain, which screens npm and pnpm installs for malware and holds brand-new releases for 24 hours.
blog · aikido.dev
The Startup's Open-Source Guide to Application Security
Most breaches start with cloud misconfig, leaked secrets, or vulnerable dependencies. The guide maps free tools—Cloudsploit, Trufflehog, gitleaks, Trivy—to build a startup security stack at zero cost.
Back