using client to scan the clone repo and return the result with "hashed_secret"

[saturbo]

Hi guys, I want to ask a stupid question, I am using the client side tools to scan all the clone repo, as a result , I got all the result with "hasd_secret". My question is --is it possible to show the result without hash so that I can show with my IT team to further check the code.?

[saturbo]

supplement some case:

"results": {
"src/main/resources/application.yml": [
{
"hashed_secret": "6cf121a60a3c78f941651f6e01906dfec489cdb2",
"line_number": 44,
"type": "Secret Keyword"
},
{
"hashed_secret": "d1d71eeb23a0c194704129c41502e4c780f3160c",
"line_number": 44,
"type": "Base64 High Entropy String"

[dgzlopes]

I don't know If detect-secrets is able to generate a baseline file without hashing secrets, but If you want to audit the results generated by detect-secrets scan then detect-secrets audit works flawlessly. It shows the secret, some context about where it appears and you can even tag it as a valid secret or a false-positive.

If you want to give It a spin, just redirect scan output (called baseline) to its own file with detect-secrets scan > .secrets.baseline and then run detect-secrets audit .secrets.baseline

[KevinHock]

Unfortunately this isn't possible to do right now, but issue #191 will fix this.

What @dgzlopes suggested is the best it can do currently

[domanchi]

FWIW, there are several reasons why I've been against having an easy way to extract these secrets in an easily shareable form (like the use case you described).

1. We don't want a file with all the secrets in it, because this is going to be tracked in source control. That's against everything this tool is about.

2. We don't want to promote a situation where you can run a command, extract all the secrets from a repository, then share that file with plain text secrets with someone. The implicit assumption from the audit functionality is that you have access to the code base, and therefore, merely exists as a helper tool (seeing that you can read the baseline, and get those secrets manually).

If you could generate a baseline with plain text secrets, you could technically share them with someone without repository access, and further worsen the issue of spreading secrets around.

@saturbo, does your IT team have code base access?

[saturbo]

@domanchi actually the IT team do have the code base access and your considering is definitely right. So I am going the show they the audio reports of the secrets in steady of showing the plain text. Thx for all the reply and suggestions!