secret-leak-sentinel

About the Project

Secret Leak Sentinel is a multi-layered platform for detecting and preventing the accidental exposure of sensitive credentials — API keys, access tokens, passwords, private certificates, database connection strings, OAuth secrets, and any other credential that could provide unauthorized access if compromised. Secret leakage is one of the fastest paths from initial exposure to full system compromise, often taking just hours from the moment a credential appears publicly to its exploitation by automated scanning bots. The platform operates at three levels: Prevention Layer includes pre-commit hooks that scan code changes before they are committed to version control, blocking accidental credential commits at the source. The hooks use a combination of regular expression patterns, entropy analysis (detecting strings with unusually high randomness), and machine learning classification to identify secrets with high accuracy and low false positive rates. Detection Layer provides continuous scanning of existing repositories, CI/CD pipeline logs, build artifacts, and cloud service configurations for previously committed secrets. Unlike one-time scanning tools, this continuous monitoring catches secrets that were committed, deleted, but remain accessible in git history. Response Layer automates the remediation workflow when a leak is detected: immediately alerting the responsible team, creating incident tickets, initiating credential rotation procedures, and tracking remediation progress through to completion. The platform supports over 200 credential types out of the box (AWS keys, GCP service accounts, Azure secrets, GitHub tokens, Stripe keys, Twilio credentials, database passwords, and many more) and allows organizations to define custom patterns for internal credential formats. All findings include context information — who committed the secret, when, in which file and line, and whether the secret appears to be a live credential or a test/example value.

Why This Matters

Secret leakage is one of the most common and most dangerous security failures in modern software development. Studies show that over 10% of public GitHub repositories contain at least one exposed secret, and automated bots scan GitHub continuously for newly committed credentials — often exploiting them within minutes of exposure. A single leaked AWS access key can lead to complete cloud infrastructure compromise, data exfiltration, and cryptocurrency mining charges that can exceed hundreds of thousands of dollars. The problem is systemic: developers work with numerous credentials daily (API keys, database passwords, service tokens) and despite best practices, mistakes happen — a credential gets hardcoded for testing and accidentally committed, a .env file is committed because .gitignore was not properly configured, or a CI/CD log exposes environment variables. Each of these scenarios creates a window of vulnerability that attackers actively exploit. This platform addresses secret leakage comprehensively — preventing new leaks at the commit level, detecting existing leaks through continuous scanning, and automating the response when leaks are discovered. The goal is to reduce the window of exposure from days or weeks (the industry average for detecting secret leaks) to minutes.

Step-by-Step Guide

1. Install the pre-commit hook for local prevention by running 'sentinel install-hook' in each repository. The hook runs in under 2 seconds for typical commits and blocks any commit containing detected credentials. Developers can use 'sentinel allow --hash <hash>' to explicitly approve false positives. The hook works with git and supports all programming languages.
2. Configure continuous scanning on your organization's repositories by connecting to your GitHub/GitLab/Bitbucket organization via the provided OAuth integration. The scanner will analyze all repositories (including git history), scheduled to run daily with immediate scanning on push events. Results are available in the web dashboard within minutes.
3. Define custom detection rules for credential patterns specific to your environment. The rule engine supports regular expressions, entropy thresholds, and contextual analysis (filename patterns, proximity to known secret variable names). Examples of custom rules are provided in /rules/examples/ for internal API key formats, database connection strings, and proprietary token patterns.
4. Configure automated response workflows including real-time alerts (Slack, email, PagerDuty), automatic Jira/ServiceNow ticket creation for remediation tracking, and integration with secret rotation APIs (AWS Secrets Manager, HashiCorp Vault) for automated credential rotation when leaks are confirmed. Monitor remediation SLA compliance through the executive dashboard.

Technologies Used