Gnu Group Learning AcademyGnu Group ↗
DevSecOps Fundamentals · Module 02 of 12

Secrets detection and credential hygiene

Prevent credentials from entering source control, detect historical leaks, and respond correctly when a secret is exposed.

Learning objectives

By the end of this module, you should be able to:

  • Differentiate secret detection from secret management.
  • Explain current-tree versus Git-history scanning.
  • Respond to a leaked credential with revocation and rotation, not deletion alone.

A secret in Git is an incident

Deleting a token from the latest file does not remove it from repository history or caches. Revoke or rotate first, then remove and investigate exposure.

Scan at multiple points

Developer hooks reduce feedback time; CI scans enforce shared policy; periodic history scans detect old or newly recognized patterns.

  • pre-commit
  • pull request
  • default branch/history

Reduce false positives safely

Use narrow allowlists with owner, reason and expiry. Never silence a whole class of findings because one test fixture is noisy.

Worked example

Leak response

Finding → validate → revoke/rotate → remove → history/exposure review → prevention improvement
  • Connect each finding to a concrete risk and control.
  • Preserve evidence so a reviewer can reproduce the decision.
Core lab · account-free

Lab 02 — Detect a synthetic credential without exposing a real one

Goal: Practice secret-response reasoning with a clearly fake token.

Before you start

  • No cloud account required.
  • Core lab uses bash/Python 3 and local files only.
STEP 1

Create a fake fixture

mkdir -p /tmp/devsecops-secrets && printf '%s\n' 'DEMO_TOKEN=ghp_DEMO_NOT_REAL_1234567890' > /tmp/devsecops-secrets/.env
STEP 2

Detect with a safe pattern

python3 - <<'PY'
import re,pathlib
p=pathlib.Path('/tmp/devsecops-secrets/.env').read_text()
assert re.search(r'ghp_DEMO_NOT_REAL_[A-Za-z0-9]+',p)
print('synthetic secret detected')
PY
STEP 3

Write response order

Record why revoke/rotate must happen before assuming deletion has solved exposure.

Verify

  • The synthetic token is detected.
  • Your response includes revocation/rotation and exposure review.

Expected outcome

  • No real credentials are used.

Diagnose / troubleshoot

  • If your pattern is too broad, narrow it to the training prefix.
  • Never paste a real token into scanner output for demonstration.
Real-world connection

Fast secret detection matters, but containment requires credential lifecycle action.

Optional real-tool lab

Optional tool lab — Gitleaks

Scan a disposable repository or directory with Gitleaks.

Prerequisites

  • Install the referenced open-source CLI only for the optional lab.
  • Use an organization-approved pinned version in real CI; do not blindly use latest.

Cost / risk

  • Expected cloud cost: none. Use only approved repositories and disposable training artifacts.

Warnings

  • Never scan or publish real production secrets in a training lab.
  • Scanner output is evidence for triage, not an automatic statement of exploitable risk.
TOOL 1
gitleaks version
TOOL 2
gitleaks dir /tmp/devsecops-secrets --redact --report-format json --report-path /tmp/gitleaks.json || true
TOOL 3
test -s /tmp/gitleaks.json && echo 'report created' || true
Avoid these traps

Common mistakes

  • Committing a real token to test the scanner.
  • Deleting the file but not revoking the credential.
  • Using an unowned permanent allowlist.
Knowledge check

Can you connect the finding to the control?

Three concept checks plus one scenario check.

1What should happen first after a real credential leak?

Revoke or rotate the exposed credential, then remove it and investigate exposure.

2Why scan Git history?

A secret can remain in earlier commits after it is removed from the current tree.

3What is a safe exception?

A narrow, documented, owned and expiring suppression for a proven false positive or accepted case.

4Scenario: a token is removed from main but was pushed yesterday. Is the incident closed?

No. Rotate/revoke it and review history, logs and downstream use because the old value remains exposed.

My Learning

Record your progress for this module.

Progress is saved in this browser immediately. When you sign in to My Learning, it can also sync across devices.

Not started

Attempt the core lab and knowledge checks before marking the module complete.