High false positive rate for secrets.patterns=[A-Z0-9]{20} about git-secrets HOT 6 CLOSED

👍 for more secret pattern management interfaces on the cli.

from git-secrets.

This pattern will match tons of JS files for various reasons such as embedded image data.

from git-secrets.

Having to write a regex to prevent false positive is also a show stopper. Think about the embedded images in JS pattern.

from git-secrets.

#57 might help with this

from git-secrets.

git-secrets shouldn't scan binary files, so that shouldn't be an issue. This pattern does match SHA-1 hashes, so I agree that it does have a high false positive rate. I'm hesitant to remove this regex now, at least without a major version bump; while it is chatty, it does prevent things like AWS access keys from being committed.

I thought that removing patterns from git-secrets is pretty simple: all you need to do is edit your .git/config file and remove the patterns you don't like under the [secrets] section. For example, in this case, you would remove the line patterns = [A-Z0-9]{20}.

For a more automated method for removing a pattern, what would you think about adding the ability to remove a pattern to git-secrets from the command line?

from git-secrets.

Closed by #89

from git-secrets.