From 5c9259c5b0bd542e4cc6d26d7c98c031456f6c03 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 11 Dec 2025 16:06:37 +0100 Subject: [PATCH 1/8] deleted --- gitleaks.toml | 61 --------------------------------------------------- 1 file changed, 61 deletions(-) delete mode 100644 gitleaks.toml diff --git a/gitleaks.toml b/gitleaks.toml deleted file mode 100644 index 8b2aeb3..0000000 --- a/gitleaks.toml +++ /dev/null @@ -1,61 +0,0 @@ -title = "Peer Rust Backend Gitleaks Config" - -[[rules]] -id = "rust-backend-catch-common-secrets" -description = "Catch common secrets in Rust backend (API keys, JWTs, database passwords, tokens, private keys)" -regex = '''(?i)(ghp_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z_]{20,}|glpat-[0-9A-Za-z\-_]{20}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+|-----BEGIN( RSA| DSA| EC| OPENSSH)? PRIVATE KEY-----|token\s*=\s*["'][A-Za-z0-9_\-]{10,}["']|password\s*=\s*["'][^"']{6,}["']|api[_-]?key\s*[:=]\s*["'][A-Za-z0-9_\-]{10,}["'])''' -tags = ["rust", "backend", "api", "key", "secret"] - -[[rules]] -id = "jwt-and-oauth-tokens" -description = "Detect JWTs, OAuth tokens, or long Base64-like secrets" -regex = '''eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+''' -tags = ["jwt", "token", "auth"] - -[[rules]] -id = "database-and-service-creds" -description = "Detect Postgres, Redis, or service connection strings" -regex = '''(?i)(postgres(?:ql)?:\/\/[A-Za-z0-9:_@.\-\/]+|redis:\/\/[A-Za-z0-9:_@.\-\/]+|mongodb:\/\/[A-Za-z0-9:_@.\-\/]+)''' -tags = ["database", "rust", "service"] - -[[rules]] -id = "aws-and-cloud-creds" -description = "Detect AWS, GCP, or generic cloud provider credentials" -regex = '''(?i)(AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|GOOG1E[A-Za-z0-9_-]{30,}|gcp_project_id\s*[:=]\s*["'][A-Za-z0-9_\-]{5,}["'])''' -tags = ["cloud", "aws", "gcp"] - -[[rules]] -id = "rust-env-files" -description = "Detect sensitive environment variable values in .env or config.rs" -regex = '''(?i)(DATABASE_URL\s*=\s*["'][^"']+["']|JWT_SECRET\s*=\s*["'][^"']+["']|API_KEY\s*=\s*["'][A-Za-z0-9_\-]{10,}["']|SECRET_KEY\s*=\s*["'][A-Za-z0-9_\-]{10,}["'])''' -tags = ["rust", "dotenv", "config", "key"] - -[rules.allowlist] -description = "Allow safe constants and test patterns" -regexes = [ - '''(?i)test_(user|token|api|key|password)''', - '''(?i)example\.com''', - '''(?i)localhost''', - '''(?i)127\.0\.0\.1''', - '''(?i)env::var''', - '''(?i)std::env''', - '''(?i)println!''', - '''(?i)mock(|_data|_value)''', - '''(?i)sample(|_key|_token)''', - '''(?i)fake(|_jwt|_uuid|_token)''' -] - -[pathDenylist] -description = "Exclude irrelevant or generated files" -regexes = [ - '''^target/.*''', - '''^dist/.*''', - '''^build/.*''', - '''^logs?/.*''', - '''^tmp/.*''', - '''^\.env.*$''', - '''^\.github/workflows/.*''', - '''^\.git/.*''', - '''^node_modules/.*''', - '''^tests?/.*''' -] From 1861ecf0ad73a8953b8e55a3f130b1bc9f0f21f8 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 11 Dec 2025 16:06:42 +0100 Subject: [PATCH 2/8] deleted --- README_gitleaks.md | 73 ---------------------------------------------- 1 file changed, 73 deletions(-) delete mode 100644 README_gitleaks.md diff --git a/README_gitleaks.md b/README_gitleaks.md deleted file mode 100644 index 61716bc..0000000 --- a/README_gitleaks.md +++ /dev/null @@ -1,73 +0,0 @@ -# ๐Ÿ”’ Gitleaks Pre-Commit Hook (Peer-rust-backend) - -This repository uses **[Gitleaks](https://github.com/gitleaks/gitleaks)** to prevent secrets (API keys, passwords, tokens, etc.) from being committed. - ---- - -## ๐Ÿš€ Setup - -Run the setup script once: - -```bash -chmod +x setup-hooks.sh -./setup-hooks.sh -``` - -This will: - -- Configure Git to use .githooks/ as the hooks directory. -- Make .githooks/pre-commit executable. -- Ensure gitleaks is installed (v8.28.0). - -If missing, the script will download the correct binary for your OS/architecture. - -Confirm the hook is ready. - -๐Ÿ›ก๏ธ Pre-Commit Scan -On every git commit, the hook will: - -- Run a Gitleaks scan on staged changes only. -- Block the commit if potential secrets are detected. -- Write results to .gitleaks_out/gitleaks-precommit.json. - -If a commit is blocked: - -- Check .gitleaks_out/gitleaks-precommit.json for details. -- Remove or mask the secret before retrying. - -Do not bypass with git commit --no-verify โ€” CI will still block your PR. - ---- - -### - -Docker Fallback - -If a local Gitleaks binary is missing, the pre-commit hook will fall back to Docker: - -docker run --rm -i -v "$(pwd)":/repo ghcr.io/gitleaks/gitleaks:v8.28.0 detect ... - ---- - -### -โœ… Verifying Installation -To check that everything is set up correctly: - -``` -gitleaks version -``` -# should print: 8.28.0 - ---- - -### -๐Ÿงน Ignore False Positives -If Gitleaks flags something that is not a real secret: - -Talk to your Team Lead / DevOps. - -They can add an exception to gitleaks.toml. - -With this setup, secrets are scanned locally before every commit and again in CI, ensuring strong security across the repo. ๐Ÿ” - -Gitleaks is set ๐Ÿš€ \ No newline at end of file From 6e1bfcdac53c0cf9fc06339f344cd8324689bae9 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 11 Dec 2025 16:06:47 +0100 Subject: [PATCH 3/8] deleted --- setup-hooks.sh | 52 -------------------------------------------------- 1 file changed, 52 deletions(-) delete mode 100644 setup-hooks.sh diff --git a/setup-hooks.sh b/setup-hooks.sh deleted file mode 100644 index 8eadbef..0000000 --- a/setup-hooks.sh +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/sh -set -e - -echo "Setting up Git hooks..." - -# Point Git to .githooks directory -git config core.hooksPath .githooks - -# Ensure pre-commit is executable -chmod +x .githooks/pre-commit - -echo "Git hooks installed. Pre-commit scan will now run automatically." - -# Check if gitleaks is installed -if command -v gitleaks >/dev/null 2>&1; then - echo "โšก Gitleaks already installed: $(gitleaks version)" - exit 0 -fi - -# Install Gitleaks if missing -VERSION="8.28.0" -OS=$(uname -s | tr '[:upper:]' '[:lower:]') -ARCH=$(uname -m) - -echo "Installing Gitleaks v$VERSION for $OS-$ARCH..." - -case "$OS-$ARCH" in - linux-x86_64) - URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_x64.tar.gz" - ;; - linux-aarch64) - URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_arm64.tar.gz" - ;; - darwin-arm64) - URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_darwin_arm64.tar.gz" - ;; - darwin-x86_64) - URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_darwin_x64.tar.gz" - ;; - *) - echo "Unsupported OS/Arch ($OS-$ARCH). Please install manually:" - echo "https://github.com/gitleaks/gitleaks/releases/tag/v$VERSION" - exit 1 - ;; -esac - -curl -sSL "$URL" -o gitleaks.tar.gz -tar -xvzf gitleaks.tar.gz gitleaks -sudo mv gitleaks /usr/local/bin/ -rm -f gitleaks.tar.gz - -echo "Installed Gitleaks v$(gitleaks version)" \ No newline at end of file From 62320bb37f68bd2d464c9a32cbb977429224496a Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 11 Dec 2025 16:07:14 +0100 Subject: [PATCH 4/8] refrenced gileaks.toml file path --- .githooks/pre-commit | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.githooks/pre-commit b/.githooks/pre-commit index c540190..10b903d 100644 --- a/.githooks/pre-commit +++ b/.githooks/pre-commit @@ -9,7 +9,7 @@ if command -v gitleaks >/dev/null 2>&1; then echo "โšก Using local gitleaks binary" SCAN_CMD="gitleaks detect \ --pipe \ - --config=gitleaks.toml \ + --config=.security/gitleaks.toml \ --report-format=json \ --report-path=.gitleaks_out/gitleaks-precommit.json \ --no-banner" @@ -17,7 +17,7 @@ else echo "Local gitleaks not found, using Docker fallback" SCAN_CMD="docker run --rm -i -v \"$(pwd)\":/repo ghcr.io/gitleaks/gitleaks:v8.28.0 detect \ --pipe \ - --config=/repo/gitleaks.toml \ + --config=/repo/.security/gitleaks.toml \ --report-format=json \ --report-path=/repo/.gitleaks_out/gitleaks-precommit.json \ --no-banner" From 2496691cf0c5629ae5f25ed52e3539e9344195cf Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 11 Dec 2025 16:07:18 +0100 Subject: [PATCH 5/8] refrenced gileaks.toml file path --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 41e96d2..9736116 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -17,7 +17,7 @@ jobs: name: Run Gitleaks Scan uses: peer-network/peer_global_security/.github/workflows/gitleaks.yml@main with: - config: gitleaks.toml + config: .security/gitleaks.toml trivy_scan: name: Run Trivy Security Scan From e891d77e087f68684b85ea1052f287854d937a11 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 11 Dec 2025 16:07:31 +0100 Subject: [PATCH 6/8] moved to new folder --- .security/gitleaks.toml | 61 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 .security/gitleaks.toml diff --git a/.security/gitleaks.toml b/.security/gitleaks.toml new file mode 100644 index 0000000..8b2aeb3 --- /dev/null +++ b/.security/gitleaks.toml @@ -0,0 +1,61 @@ +title = "Peer Rust Backend Gitleaks Config" + +[[rules]] +id = "rust-backend-catch-common-secrets" +description = "Catch common secrets in Rust backend (API keys, JWTs, database passwords, tokens, private keys)" +regex = '''(?i)(ghp_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z_]{20,}|glpat-[0-9A-Za-z\-_]{20}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+|-----BEGIN( RSA| DSA| EC| OPENSSH)? PRIVATE KEY-----|token\s*=\s*["'][A-Za-z0-9_\-]{10,}["']|password\s*=\s*["'][^"']{6,}["']|api[_-]?key\s*[:=]\s*["'][A-Za-z0-9_\-]{10,}["'])''' +tags = ["rust", "backend", "api", "key", "secret"] + +[[rules]] +id = "jwt-and-oauth-tokens" +description = "Detect JWTs, OAuth tokens, or long Base64-like secrets" +regex = '''eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+''' +tags = ["jwt", "token", "auth"] + +[[rules]] +id = "database-and-service-creds" +description = "Detect Postgres, Redis, or service connection strings" +regex = '''(?i)(postgres(?:ql)?:\/\/[A-Za-z0-9:_@.\-\/]+|redis:\/\/[A-Za-z0-9:_@.\-\/]+|mongodb:\/\/[A-Za-z0-9:_@.\-\/]+)''' +tags = ["database", "rust", "service"] + +[[rules]] +id = "aws-and-cloud-creds" +description = "Detect AWS, GCP, or generic cloud provider credentials" +regex = '''(?i)(AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|GOOG1E[A-Za-z0-9_-]{30,}|gcp_project_id\s*[:=]\s*["'][A-Za-z0-9_\-]{5,}["'])''' +tags = ["cloud", "aws", "gcp"] + +[[rules]] +id = "rust-env-files" +description = "Detect sensitive environment variable values in .env or config.rs" +regex = '''(?i)(DATABASE_URL\s*=\s*["'][^"']+["']|JWT_SECRET\s*=\s*["'][^"']+["']|API_KEY\s*=\s*["'][A-Za-z0-9_\-]{10,}["']|SECRET_KEY\s*=\s*["'][A-Za-z0-9_\-]{10,}["'])''' +tags = ["rust", "dotenv", "config", "key"] + +[rules.allowlist] +description = "Allow safe constants and test patterns" +regexes = [ + '''(?i)test_(user|token|api|key|password)''', + '''(?i)example\.com''', + '''(?i)localhost''', + '''(?i)127\.0\.0\.1''', + '''(?i)env::var''', + '''(?i)std::env''', + '''(?i)println!''', + '''(?i)mock(|_data|_value)''', + '''(?i)sample(|_key|_token)''', + '''(?i)fake(|_jwt|_uuid|_token)''' +] + +[pathDenylist] +description = "Exclude irrelevant or generated files" +regexes = [ + '''^target/.*''', + '''^dist/.*''', + '''^build/.*''', + '''^logs?/.*''', + '''^tmp/.*''', + '''^\.env.*$''', + '''^\.github/workflows/.*''', + '''^\.git/.*''', + '''^node_modules/.*''', + '''^tests?/.*''' +] From 262d2b748d48a5d70769045804d1cc50a98ea7d9 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 11 Dec 2025 16:07:35 +0100 Subject: [PATCH 7/8] moved to new folder --- .security/Readme_gitleaks.md | 73 ++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 .security/Readme_gitleaks.md diff --git a/.security/Readme_gitleaks.md b/.security/Readme_gitleaks.md new file mode 100644 index 0000000..61716bc --- /dev/null +++ b/.security/Readme_gitleaks.md @@ -0,0 +1,73 @@ +# ๐Ÿ”’ Gitleaks Pre-Commit Hook (Peer-rust-backend) + +This repository uses **[Gitleaks](https://github.com/gitleaks/gitleaks)** to prevent secrets (API keys, passwords, tokens, etc.) from being committed. + +--- + +## ๐Ÿš€ Setup + +Run the setup script once: + +```bash +chmod +x setup-hooks.sh +./setup-hooks.sh +``` + +This will: + +- Configure Git to use .githooks/ as the hooks directory. +- Make .githooks/pre-commit executable. +- Ensure gitleaks is installed (v8.28.0). + +If missing, the script will download the correct binary for your OS/architecture. + +Confirm the hook is ready. + +๐Ÿ›ก๏ธ Pre-Commit Scan +On every git commit, the hook will: + +- Run a Gitleaks scan on staged changes only. +- Block the commit if potential secrets are detected. +- Write results to .gitleaks_out/gitleaks-precommit.json. + +If a commit is blocked: + +- Check .gitleaks_out/gitleaks-precommit.json for details. +- Remove or mask the secret before retrying. + +Do not bypass with git commit --no-verify โ€” CI will still block your PR. + +--- + +### + +Docker Fallback + +If a local Gitleaks binary is missing, the pre-commit hook will fall back to Docker: + +docker run --rm -i -v "$(pwd)":/repo ghcr.io/gitleaks/gitleaks:v8.28.0 detect ... + +--- + +### +โœ… Verifying Installation +To check that everything is set up correctly: + +``` +gitleaks version +``` +# should print: 8.28.0 + +--- + +### +๐Ÿงน Ignore False Positives +If Gitleaks flags something that is not a real secret: + +Talk to your Team Lead / DevOps. + +They can add an exception to gitleaks.toml. + +With this setup, secrets are scanned locally before every commit and again in CI, ensuring strong security across the repo. ๐Ÿ” + +Gitleaks is set ๐Ÿš€ \ No newline at end of file From 3dd76dcf0b1f850c0eee62e880e936616402436b Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Thu, 11 Dec 2025 16:07:38 +0100 Subject: [PATCH 8/8] moved to new folder --- .security/setup-hooks.sh | 52 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 .security/setup-hooks.sh diff --git a/.security/setup-hooks.sh b/.security/setup-hooks.sh new file mode 100644 index 0000000..8eadbef --- /dev/null +++ b/.security/setup-hooks.sh @@ -0,0 +1,52 @@ +#!/bin/sh +set -e + +echo "Setting up Git hooks..." + +# Point Git to .githooks directory +git config core.hooksPath .githooks + +# Ensure pre-commit is executable +chmod +x .githooks/pre-commit + +echo "Git hooks installed. Pre-commit scan will now run automatically." + +# Check if gitleaks is installed +if command -v gitleaks >/dev/null 2>&1; then + echo "โšก Gitleaks already installed: $(gitleaks version)" + exit 0 +fi + +# Install Gitleaks if missing +VERSION="8.28.0" +OS=$(uname -s | tr '[:upper:]' '[:lower:]') +ARCH=$(uname -m) + +echo "Installing Gitleaks v$VERSION for $OS-$ARCH..." + +case "$OS-$ARCH" in + linux-x86_64) + URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_x64.tar.gz" + ;; + linux-aarch64) + URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_arm64.tar.gz" + ;; + darwin-arm64) + URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_darwin_arm64.tar.gz" + ;; + darwin-x86_64) + URL="https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_darwin_x64.tar.gz" + ;; + *) + echo "Unsupported OS/Arch ($OS-$ARCH). Please install manually:" + echo "https://github.com/gitleaks/gitleaks/releases/tag/v$VERSION" + exit 1 + ;; +esac + +curl -sSL "$URL" -o gitleaks.tar.gz +tar -xvzf gitleaks.tar.gz gitleaks +sudo mv gitleaks /usr/local/bin/ +rm -f gitleaks.tar.gz + +echo "Installed Gitleaks v$(gitleaks version)" \ No newline at end of file