README
¶
rvsecret
A hard fork of wraith (which itself is a hard fork of gitrob)
rvsecret detects secrets in git repositories (or localpath). The big differentiator is it is tightly integrated with Github and Gitlab APIs and has no extra dependencies. It's just one binary you can use anywhere (even in scratch containers).
It is still very much WIP!
The tool is undergoing a big refactor at the moment, hence it's not stable to be used yet. For detailed refactoring plans checkout TODO.md.
Capabilities
Targets
- Gitlab.com repositories and projects
- Github.com repositories and organizations
- Local git repositories
- Local filesystem
Major Features
- Exclude files, paths, and extensions
- Web and terminal interfaces for real-time results (very much alpha)
- Configurable commit depth
Screenshots
Quickstart
- Compile it (
make build) - Download the signature file to
~/.rvsecret/signatures/ - Use it:
bin/rvsecret-darwin scan local-git-repo --local-repos rumenvasilev/terraform
Documentation
Build from source
To build from source, you need Go 1.21.
$ cd $GOPATH/src
$ git clone git@github.com:rumenvasilev/rvsecret.git
$ cd rvsecret
$ make build
$ ./bin/rvsecret-<ARCH> <sub-command>
Signatures
Signatures are the current method used to detect secrets within a target source. They are broken out into the wraith-signatures repo for extensability purposes. This allows them to be independently versioned and developed without having to recompile the code. To make changes just edit an existing signature or create a new one. Check the README in that repo for additional details.
Authencation
rvsecret will need either a GitLab or Github access token in order to interact with their appropriate API's. You can create a GitLab personal access token, or a Github personal access token and save it in an environment variable in your bashrc, add it to a rvsecret config file, or pass it in on the command line. Passing it in on the commandline should be avoided if possible for security reasons. Of course if you want to eat your own dog food, go ahead and do it that way, then point rvsecret at your command history file. 😈
Contributing
Fork, PR and lets have a chat. Outstanding work is in TODO.md.
Documentation
¶
Overview ¶
Copyright © 2020 Matty Jones
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package cmd represents the specific commands that the user will execute.
|
Package cmd represents the specific commands that the user will execute. |
|
scan
Package cmd represents the specific commands that the user will execute.
|
Package cmd represents the specific commands that the user will execute. |
|
internal
|
|
|
core
Package core represents the core functionality of all commands
|
Package core represents the core functionality of all commands |
|
core/banner
Package core represents the core functionality of all commands
|
Package core represents the core functionality of all commands |