Exercise: Introduction to Secret Scanning

[github-actions]

Introduction to Secret Scanning

👋 Hey there AndresNico! Welcome to your Skills exercise!

In this exercise, you'll learn how to identify and protect sensitive information in your repositories. 🔍 Let's work together to keep your code secure! 🛡️

As you complete each step, I will respond in the comments to:

• check your work and give feedback
• share next steps
• occasionally share tips
• congratulate you when you finish!

Good luck and have fun!
- Mona

[github-actions]

Step 1: Enable Secret Protection

If you check your email, you probably just got an alert from GitHub with the subject "Possible valid secrets found". Oh no! 😮

Don't worry! We put some expired credentials in the exercise on purpose since public repositories get secret protection for free. Nice! 🕵️

In this step, you will enable secret protection on your repository. After it is enabled, you will add a new credential to see how secret protection identifies the credential and alerts you.

Warning

If your repository is private, you will need GitHub Advanced Security to continue. We recommend changing this exercise repository to public to enable it.

What is a secret?

In the our context, a secret (or credential) is a plain-text string, or a pair of strings, that authorizes access a service. Examples could be AWS secret access keys/ID's, Google API keys, or GitHub Personal Access Tokens (PATs).

The GitHub Docs provides a list of all supported patterns.

What is secret protection?

Secret protection is a powerful tool which allows teams to identify these plain-text credentials, remove them, and create rules to prevent them from being written to GitHub in the first place.

Secret protection is available for free for public repositories on all plans. Enterprises that need secret protection capabilities for private repositories should review GitHub Advanced Security. Not only does it include secret protection, it also provides advanced static analysis, software composition analysis (SCA), and enterprise tools to manage your entire AppSec pipeline and reduce your risk profile.

⌨️ Activity: Configure secret protection

1. In the header of your repository, open Settings in a new browser tab.

2. In the left navigation, under the Security section, select Advanced Security.

3. Scroll down past the Code Scanning and Dependabot sections until you find the Secret Protection section.

   💡 Tip: We also have exercises about code scanning and supply chain protection!

4. Adjust the default configuration to match the below.

   • Secret Protection: enabled
   • Push Protection: disabled
   

⌨️ Activity: Commit a sensitive file

Now let's (accidentally) commit a sensitive file to see how it works. Don't worry, these are inactive credentials.

1. In the header of your repository, click the Code tab.

2. Above the list of files, click the Add file dropdown and select Create new file.

   

3. Enter the file name credentials.yml and copy following inactive example credentials into it.

   

   default:
     aws_access_key_id: AKIAQYLPMN5HNM4OZ56B
     aws_secret_access_key: Rm29CHLQCeaT6V/Rsw3UFWW1/UWQ0lhsWBa3bdca
     mongodb: mongodb+srv://svc-admin:kLeioeBne5lsopPf@mergington-high.avocado.mongodb.net
     output: json
     region: us-east-2

4. In the top right, use the Commit changes... button to commit directly to the main branch.

   ❗️ Important: Committing to your default branch is not usually a recommended practice. We only do this to simplify the exercise.

5. With our credentials file (accidentally) shared, Mona should quickly notice it and prepare the next step.

[github-actions]

Please, follow the steps above.
I'll watch your progress in the background to provide feedback. 🧐