Supporting passwords

[professor]

I noticed that on a recent leak, that a couple of fields would not have been caught by cred-alert. At the time, we were not using cred-alert. We are now, and it would be nice to catch these situations.

ivyrepo_passwd: "snipped"
docker_password: snipped

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. Unfortunately, the Pivotal Tracker project is private so you may be unable to view the contents of the story.

The labels on this github issue will be updated when the story is started.

[ghost]

I was wondering about this same thing.

The underlying question, what exactly constitutes a credential?

I scanned my .ssh directory, and it recognized pem keys. I scanned my .aws/credentials and it found those easily.

What if I have a password in a terraform file? For example:

my_rds_password = "abc"

Are these types of credentials supposed to get caught?