wip: snapshot das alterações não commitadas (2026-10-20)
Origem: D:/Documents/Github/dev-workflows Arquivos omitidos (segredos, bancos de dados, logs, >50 MB): 0
This commit is contained in:
evandro committed
1 parent
c17192c9fe
commit
2ef6f6be10
61 files changed
+7892
No files matched your search
@@ -0,0 +1,147 @@
|
||||
# Play: Secrets Scan
|
||||
|
||||
Detect hardcoded credentials, API keys, tokens, and other secrets in source code and configuration files.
|
||||
|
||||
## Trigger Conditions
|
||||
|
||||
Use this skill when:
|
||||
- Reviewing code for leaked secrets before commit or merge
|
||||
- Auditing a repository for historical secret exposure
|
||||
- A user asks to check for hardcoded credentials
|
||||
- Setting up pre-commit hooks for secret detection
|
||||
|
||||
## Inputs
|
||||
|
||||
- Repository or directory to scan
|
||||
- (Optional) List of known-safe patterns to ignore (e.g., test fixtures, example placeholders)
|
||||
- (Optional) Whether to scan git history or just current files
|
||||
|
||||
## Procedure
|
||||
|
||||
### 1. Run Automated Scanner
|
||||
|
||||
Use available tools in order of preference:
|
||||
|
||||
1. **trufflehog** (recommended — scans current files + git history):
|
||||
```bash
|
||||
trufflehog filesystem --directory=<path> --json
|
||||
trufflehog git file://<repo_path> --json # includes git history
|
||||
```
|
||||
|
||||
2. **gitleaks** (git-aware scanning):
|
||||
```bash
|
||||
gitleaks detect --source=<path> --report-format=json --report-path=results.json
|
||||
```
|
||||
|
||||
3. **detect-secrets** (Yelp's baseline-aware scanner):
|
||||
```bash
|
||||
detect-secrets scan <path> --all-files
|
||||
```
|
||||
|
||||
If no scanner is installed, proceed with manual analysis.
|
||||
|
||||
### 2. Manual Pattern Analysis
|
||||
|
||||
Search for these high-confidence patterns:
|
||||
|
||||
#### API Keys & Tokens
|
||||
| Pattern | Service | Regex Hint |
|
||||
|---------|---------|-----------|
|
||||
| `AKIA[0-9A-Z]{16}` | AWS Access Key ID | Exact format |
|
||||
| `sk-[a-zA-Z0-9]{48}` | OpenAI API Key | Prefix match |
|
||||
| `sk-ant-[a-zA-Z0-9-]{80,}` | Anthropic API Key | Prefix match |
|
||||
| `ghp_[a-zA-Z0-9]{36}` | GitHub Personal Access Token | Prefix match |
|
||||
| `gho_`, `ghu_`, `ghs_`, `ghr_` | GitHub OAuth/App tokens | Prefix match |
|
||||
| `xoxb-`, `xoxp-`, `xoxs-` | Slack tokens | Prefix match |
|
||||
| `SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}` | SendGrid API Key | Format match |
|
||||
| `sk_live_`, `pk_live_`, `rk_live_` | Stripe keys | Prefix match |
|
||||
|
||||
#### Credentials in Config
|
||||
| Pattern | What to Look For |
|
||||
|---------|-----------------|
|
||||
| Connection strings | `://user:password@host` patterns |
|
||||
| Password assignments | `password = "..."`, `PASSWORD: ...`, `passwd`, `secret` |
|
||||
| Private keys | `-----BEGIN (RSA\|EC\|OPENSSH) PRIVATE KEY-----` |
|
||||
| Certificates | PEM-encoded certificates with private key material |
|
||||
| JWT secrets | `JWT_SECRET`, `TOKEN_SECRET` assignments |
|
||||
| Database credentials | `DB_PASSWORD`, `MONGO_URI`, `DATABASE_URL` with embedded credentials |
|
||||
|
||||
#### High-Risk File Patterns
|
||||
Scan these files with extra scrutiny:
|
||||
- `.env`, `.env.*` files
|
||||
- `**/config/**`, `**/settings/**`
|
||||
- `docker-compose*.yml` (environment sections)
|
||||
- `*.tfvars`, `terraform.tfstate`
|
||||
- `kubeconfig`, `*.kubeconfig`
|
||||
- `credentials`, `credentials.json`, `service-account*.json`
|
||||
- `.npmrc`, `.pypirc`, `pip.conf` (registry tokens)
|
||||
- `**/ci/**`, `.github/workflows/**` (inline secrets)
|
||||
|
||||
### 3. Contextual Analysis
|
||||
|
||||
For each detected secret:
|
||||
|
||||
1. **Is it real?** Filter out:
|
||||
- Placeholder values (`CHANGE_ME`, `xxx`, `your-api-key-here`, `<token>`)
|
||||
- Test fixtures with known dummy values
|
||||
- Documentation examples
|
||||
- Base64-encoded non-secret data that matches key patterns
|
||||
|
||||
2. **Is it active?** If possible:
|
||||
- Check if the key format is currently valid for the service
|
||||
- Look for rotation evidence (was it replaced in a later commit?)
|
||||
- Check `.gitignore` — is the file supposed to be excluded?
|
||||
|
||||
3. **What's the blast radius?**
|
||||
- What service does this credential access?
|
||||
- What permissions does it grant?
|
||||
- Is it a production or development credential?
|
||||
- How long has it been exposed?
|
||||
|
||||
### 4. Check Preventive Controls
|
||||
|
||||
Verify that the project has:
|
||||
- [ ] `.gitignore` entries for sensitive files (`.env`, `*.key`, `*.pem`, tfstate, etc.)
|
||||
- [ ] Pre-commit hooks for secret scanning (trufflehog, gitleaks, detect-secrets)
|
||||
- [ ] CI pipeline secret scanning step
|
||||
- [ ] Documentation on how to manage secrets (env vars, vault, etc.)
|
||||
- [ ] `.gitleaks.toml` or equivalent allowlist config for known false positives
|
||||
|
||||
## Output Format
|
||||
|
||||
```markdown
|
||||
## Secrets Scan: [Repository/Directory]
|
||||
|
||||
### Scan Summary
|
||||
- **Scanner used**: [tool or manual]
|
||||
- **Scope**: Current files | Git history | Both
|
||||
- **Files scanned**: [count]
|
||||
- **Secrets found**: [count by category]
|
||||
|
||||
### Findings
|
||||
[Standard finding template for each secret, with type and blast radius]
|
||||
|
||||
### Preventive Controls
|
||||
| Control | Status |
|
||||
|---------|--------|
|
||||
| .gitignore covers sensitive files | Present/Missing |
|
||||
| Pre-commit secret scanning | Present/Missing |
|
||||
| CI secret scanning | Present/Missing |
|
||||
|
||||
### Immediate Actions Required
|
||||
[If active production secrets are found, list rotation steps]
|
||||
```
|
||||
|
||||
## Important Notes
|
||||
|
||||
- **Never include the actual secret value in findings.** Show a redacted version: `AKIA****EXAMPLE`
|
||||
- If active production secrets are found, flag this as requiring **immediate rotation** — the secret must be assumed compromised once it's been in version control
|
||||
- Historical secrets in git history remain accessible even after deletion from current files — git history rewriting or rotation is required
|
||||
|
||||
## OWASP References
|
||||
|
||||
- **A07:2021** — Identification and Authentication Failures
|
||||
- **CWE-798** — Use of Hard-coded Credentials
|
||||
- **CWE-312** — Cleartext Storage of Sensitive Information
|
||||
- OWASP Cheat Sheet: Secrets Management
|
||||
- OWASP WSTG-CONF-04: Review Old Backup and Unreferenced Files for Sensitive Information
|
||||
@@ -0,0 +1,48 @@
|
||||
# Finding Template
|
||||
|
||||
Use this structure for all security findings produced by skills.
|
||||
|
||||
```markdown
|
||||
### [SEVERITY] Title
|
||||
|
||||
- **ID**: NDC-YYYY-NNN (auto-incrementing)
|
||||
- **CWE**: CWE-XXX (if applicable)
|
||||
- **CVE**: CVE-YYYY-NNNNN (if applicable)
|
||||
- **OpenCRE**: [CRE-ID](https://www.opencre.org/cre/CRE-ID) — requirement name (see data/opencre/)
|
||||
- **OWASP Ref**: Top 10 A01, ASVS V4.1.1, MASVS-STORAGE-1, MASWE-0001, MASTG-TEST-0200, LLM01, etc.
|
||||
- **Location**: file_path:line_number or component name
|
||||
- **Impact**: What an attacker can achieve (1-2 sentences)
|
||||
- **Evidence**: Code snippet, command output, or proof-of-concept
|
||||
- **Remediation**: Specific fix with code example
|
||||
- **Confidence**: HIGH | MEDIUM | LOW (how certain is this finding)
|
||||
```
|
||||
|
||||
### Resolving OpenCRE Links
|
||||
|
||||
When you have a CWE, look up its OpenCRE mapping via the API:
|
||||
|
||||
```
|
||||
GET https://www.opencre.org/rest/v1/standard/CWE/sectionid/{cwe-number}
|
||||
```
|
||||
|
||||
This returns the CRE ID and linked standards (ASVS, WSTG, NIST 800-53, cheat sheets). Include the CRE link in findings to give readers one-click access to all related standards and remediation guidance.
|
||||
|
||||
Common mappings are pre-populated in `data/opencre/README.md`.
|
||||
|
||||
## Severity Definitions
|
||||
|
||||
| Severity | CVSS Range | Criteria |
|
||||
|----------|-----------|----------|
|
||||
| CRITICAL | 9.0-10.0 | Remote code execution, full system compromise, mass data breach |
|
||||
| HIGH | 7.0-8.9 | Privilege escalation, significant data exposure, auth bypass |
|
||||
| MEDIUM | 4.0-6.9 | Limited data exposure, requires user interaction or specific conditions |
|
||||
| LOW | 0.1-3.9 | Information disclosure, minor misconfigurations |
|
||||
| INFORMATIONAL | N/A | Best practice recommendations, defense-in-depth suggestions |
|
||||
|
||||
## Confidence Levels
|
||||
|
||||
| Level | Meaning |
|
||||
|-------|---------|
|
||||
| HIGH | Confirmed via code path analysis, PoC, or tool output |
|
||||
| MEDIUM | Strong indicators but not fully confirmed — needs manual verification |
|
||||
| LOW | Heuristic match or pattern-based — may be false positive |
|
||||
Reference in new issue
Block a user