Skip to content

README.md

Latest commit

 

History

History
28 lines (21 loc) · 1.23 KB

README.md

File metadata and controls

28 lines (21 loc) · 1.23 KB

Dotfiles Security

This repository includes automated secret scanning to prevent sensitive information (API keys, passwords, private keys) from being pushed to GitHub.

Security Measures

  • Secret Scanner Script: scripts/security/scan_secrets.sh - Uses git grep with robust regex patterns to find potential secrets.
  • Git Hooks:
    • pre-commit: Scans tracked files before every commit.
    • pre-push: Scans tracked files before every push.
  • GitHub Action: .github/workflows/secret-scanning.yml - Runs Gitleaks on every push to the remote.
  • Enhanced Sync Script:
    • .ignore_stow/git_push_dotfiles.sh This script explicitly runs the secret scanner before proceeding.

Installation of Git Hooks

Ensure the git hooks are executable to activate the local protection:

chmod +x .git/hooks/pre-commit .git/hooks/pre-push

The hooks are configured to call scripts/security/scan_secrets.sh before every commit and push.

How to handle false positives

If the scanner finds a false positive (a string that looks like a secret but isn't), you can:

  1. Refine the regex in scripts/security/scan_secrets.sh.
  2. Add the file or directory to the EXCLUDE list in scripts/security/scan_secrets.sh.