From 9592a2230619a440412a65dafef484adb17d1be8 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 6 Nov 2025 16:51:15 +0100 Subject: [PATCH 1/6] ignored gitleaks json --- .gitignore | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 8a939a9..2648820 100644 --- a/.gitignore +++ b/.gitignore @@ -27,4 +27,7 @@ dist build # Logs -*.log \ No newline at end of file +*.log + +# Gitleaks log +.gitleaks_out/ \ No newline at end of file From 70e9105751d14ecdab494e5782f701ed106c82f1 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 6 Nov 2025 16:51:27 +0100 Subject: [PATCH 2/6] gitleaks conf file --- gitleaks.toml | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 gitleaks.toml diff --git a/gitleaks.toml b/gitleaks.toml new file mode 100644 index 0000000..8b2aeb3 --- /dev/null +++ b/gitleaks.toml @@ -0,0 +1,61 @@ +title = "Peer Rust Backend Gitleaks Config" + +[[rules]] +id = "rust-backend-catch-common-secrets" +description = "Catch common secrets in Rust backend (API keys, JWTs, database passwords, tokens, private keys)" +regex = '''(?i)(ghp_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z_]{20,}|glpat-[0-9A-Za-z\-_]{20}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+|-----BEGIN( RSA| DSA| EC| OPENSSH)? PRIVATE KEY-----|token\s*=\s*["'][A-Za-z0-9_\-]{10,}["']|password\s*=\s*["'][^"']{6,}["']|api[_-]?key\s*[:=]\s*["'][A-Za-z0-9_\-]{10,}["'])''' +tags = ["rust", "backend", "api", "key", "secret"] + +[[rules]] +id = "jwt-and-oauth-tokens" +description = "Detect JWTs, OAuth tokens, or long Base64-like secrets" +regex = '''eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+''' +tags = ["jwt", "token", "auth"] + +[[rules]] +id = "database-and-service-creds" +description = "Detect Postgres, Redis, or service connection strings" +regex = '''(?i)(postgres(?:ql)?:\/\/[A-Za-z0-9:_@.\-\/]+|redis:\/\/[A-Za-z0-9:_@.\-\/]+|mongodb:\/\/[A-Za-z0-9:_@.\-\/]+)''' +tags = ["database", "rust", "service"] + +[[rules]] +id = "aws-and-cloud-creds" +description = "Detect AWS, GCP, or generic cloud provider credentials" +regex = '''(?i)(AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|GOOG1E[A-Za-z0-9_-]{30,}|gcp_project_id\s*[:=]\s*["'][A-Za-z0-9_\-]{5,}["'])''' +tags = ["cloud", "aws", "gcp"] + +[[rules]] +id = "rust-env-files" +description = "Detect sensitive environment variable values in .env or config.rs" +regex = '''(?i)(DATABASE_URL\s*=\s*["'][^"']+["']|JWT_SECRET\s*=\s*["'][^"']+["']|API_KEY\s*=\s*["'][A-Za-z0-9_\-]{10,}["']|SECRET_KEY\s*=\s*["'][A-Za-z0-9_\-]{10,}["'])''' +tags = ["rust", "dotenv", "config", "key"] + +[rules.allowlist] +description = "Allow safe constants and test patterns" +regexes = [ + '''(?i)test_(user|token|api|key|password)''', + '''(?i)example\.com''', + '''(?i)localhost''', + '''(?i)127\.0\.0\.1''', + '''(?i)env::var''', + '''(?i)std::env''', + '''(?i)println!''', + '''(?i)mock(|_data|_value)''', + '''(?i)sample(|_key|_token)''', + '''(?i)fake(|_jwt|_uuid|_token)''' +] + +[pathDenylist] +description = "Exclude irrelevant or generated files" +regexes = [ + '''^target/.*''', + '''^dist/.*''', + '''^build/.*''', + '''^logs?/.*''', + '''^tmp/.*''', + '''^\.env.*$''', + '''^\.github/workflows/.*''', + '''^\.git/.*''', + '''^node_modules/.*''', + '''^tests?/.*''' +] From 0923b84c1ab0c0ea7d82ef591cac7f1513cd2216 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 6 Nov 2025 16:51:36 +0100 Subject: [PATCH 3/6] Read me for gitleaks --- README_gitleaks.md | 73 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 README_gitleaks.md diff --git a/README_gitleaks.md b/README_gitleaks.md new file mode 100644 index 0000000..61716bc --- /dev/null +++ b/README_gitleaks.md @@ -0,0 +1,73 @@ +# ๐Ÿ”’ Gitleaks Pre-Commit Hook (Peer-rust-backend) + +This repository uses **[Gitleaks](https://github.com/gitleaks/gitleaks)** to prevent secrets (API keys, passwords, tokens, etc.) from being committed. + +--- + +## ๐Ÿš€ Setup + +Run the setup script once: + +```bash +chmod +x setup-hooks.sh +./setup-hooks.sh +``` + +This will: + +- Configure Git to use .githooks/ as the hooks directory. +- Make .githooks/pre-commit executable. +- Ensure gitleaks is installed (v8.28.0). + +If missing, the script will download the correct binary for your OS/architecture. + +Confirm the hook is ready. + +๐Ÿ›ก๏ธ Pre-Commit Scan +On every git commit, the hook will: + +- Run a Gitleaks scan on staged changes only. +- Block the commit if potential secrets are detected. +- Write results to .gitleaks_out/gitleaks-precommit.json. + +If a commit is blocked: + +- Check .gitleaks_out/gitleaks-precommit.json for details. +- Remove or mask the secret before retrying. + +Do not bypass with git commit --no-verify โ€” CI will still block your PR. + +--- + +### + +Docker Fallback + +If a local Gitleaks binary is missing, the pre-commit hook will fall back to Docker: + +docker run --rm -i -v "$(pwd)":/repo ghcr.io/gitleaks/gitleaks:v8.28.0 detect ... + +--- + +### +โœ… Verifying Installation +To check that everything is set up correctly: + +``` +gitleaks version +``` +# should print: 8.28.0 + +--- + +### +๐Ÿงน Ignore False Positives +If Gitleaks flags something that is not a real secret: + +Talk to your Team Lead / DevOps. + +They can add an exception to gitleaks.toml. + +With this setup, secrets are scanned locally before every commit and again in CI, ensuring strong security across the repo. ๐Ÿ” + +Gitleaks is set ๐Ÿš€ \ No newline at end of file From 408ccc64ee30d7eef885942535f59121a668ad14 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 6 Nov 2025 16:51:58 +0100 Subject: [PATCH 4/6] setup gitleaks hooks script --- setup-hooks.sh | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 setup-hooks.sh diff --git a/setup-hooks.sh b/setup-hooks.sh new file mode 100644 index 0000000..8eadbef --- /dev/null +++ b/setup-hooks.sh @@ -0,0 +1,52 @@ +#!/bin/sh +set -e + +echo "Setting up Git hooks..." + +# Point Git to .githooks directory +git config core.hooksPath .githooks + +# Ensure pre-commit is executable +chmod +x .githooks/pre-commit + +echo "Git hooks installed. Pre-commit scan will now run automatically." + +# Check if gitleaks is installed +if command -v gitleaks >/dev/null 2>&1; then + echo "โšก Gitleaks already installed: $(gitleaks version)" + exit 0 +fi + +# Install Gitleaks if missing +VERSION="8.28.0" +OS=$(uname -s | tr '[:upper:]' '[:lower:]') +ARCH=$(uname -m) + +echo "Installing Gitleaks v$VERSION for $OS-$ARCH..." + +case "$OS-$ARCH" in + linux-x86_64) + URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_x64.tar.gz" + ;; + linux-aarch64) + URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_arm64.tar.gz" + ;; + darwin-arm64) + URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_darwin_arm64.tar.gz" + ;; + darwin-x86_64) + URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_darwin_x64.tar.gz" + ;; + *) + echo "Unsupported OS/Arch ($OS-$ARCH). Please install manually:" + echo "https://github.com/gitleaks/gitleaks/releases/tag/v$VERSION" + exit 1 + ;; +esac + +curl -sSL "$URL" -o gitleaks.tar.gz +tar -xvzf gitleaks.tar.gz gitleaks +sudo mv gitleaks /usr/local/bin/ +rm -f gitleaks.tar.gz + +echo "Installed Gitleaks v$(gitleaks version)" \ No newline at end of file From 18bd4c35eb035b9276d8d6b12f60874c2001a1ea Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 6 Nov 2025 16:52:10 +0100 Subject: [PATCH 5/6] pre commit for local gitleaks --- .githooks/pre-commit | 48 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 .githooks/pre-commit diff --git a/.githooks/pre-commit b/.githooks/pre-commit new file mode 100644 index 0000000..c540190 --- /dev/null +++ b/.githooks/pre-commit @@ -0,0 +1,48 @@ +#!/bin/sh +echo "Running Gitleaks pre-commit scan on staged changes (Peer-rust-backend)..." + +mkdir -p .gitleaks_out +touch .gitleaks_out/gitleaks-precommit.json + +# Prefer local gitleaks if available, fallback to Docker +if command -v gitleaks >/dev/null 2>&1; then + echo "โšก Using local gitleaks binary" + SCAN_CMD="gitleaks detect \ + --pipe \ + --config=gitleaks.toml \ + --report-format=json \ + --report-path=.gitleaks_out/gitleaks-precommit.json \ + --no-banner" +else + echo "Local gitleaks not found, using Docker fallback" + SCAN_CMD="docker run --rm -i -v \"$(pwd)\":/repo ghcr.io/gitleaks/gitleaks:v8.28.0 detect \ + --pipe \ + --config=/repo/gitleaks.toml \ + --report-format=json \ + --report-path=/repo/.gitleaks_out/gitleaks-precommit.json \ + --no-banner" +fi + +# Run scan on staged diff only +git diff --cached --unified=0 --no-color \ + | grep '^+' \ + | grep -v '^+++' \ + | sh -c "$SCAN_CMD" +status=$? +if [ $status -ne 0 ]; then + echo "Possible secrets detected in staged changes!" + echo " See .gitleaks_out/gitleaks-precommit.json for details." + echo "" + echo "Commit aborted." + echo "" + echo "Reminder: Do NOT bypass with 'git commit --no-verify'." + echo "CI will still block your PR even if you bypass locally." + echo "" + echo "If this secret is actually required in the repo (false positive or approved usage)," + echo "you MUST meet with the CTO / Team Lead / DevOps to approve" + echo "and add it to the gitleaks ignore list." + exit 1 +fi + +echo "No secrets found. Commit allowed." +exit 0 \ No newline at end of file From 4d9a6f223be87da122f0fe3f50f29f4de4429674 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 6 Nov 2025 16:52:40 +0100 Subject: [PATCH 6/6] workflow for remote gitleaks --- .github/workflows/security.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..c9e1254 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,20 @@ +name: Security Scan + +on: + pull_request: + branches: + - development + - Test + - main + push: + branches: + - development + - Test + - main + +jobs: + gitleaks: + name: Run Gitleaks Scan + uses: peer-network/peer_global_security/.github/workflows/gitleaks.yml@main + with: + config: gitleaks.toml \ No newline at end of file