Git Secrets and Preventing Credential Leaks Tools and Best Practices

Git Secrets and Preventing Credential Leaks

Accidentally committing secrets (API keys, passwords, .env files) to Git is one of the most common security incidents. This guide covers prevention and response.

How Credentials Leak

1. Committing .env Adding .env to Git accidentally
2. Hardcoded secrets Putting API keys directly in code
3. Config files Putting secrets in config.js instead of .env
4. Test files Using real credentials in tests
5. Comments Leaving credentials in code comments
6. Git history Secrets remain in history even after removal

Prevention 1: .gitignore

# .gitignore
.env
.env.local
.env.*.local

# Also ignore common secret files
*.pem
*.key
credentials.json
service-account.json

Prevention 2: Pre-commit Hooks with git-secrets

# Install git-secrets
brew install git-secrets  # Mac
sudo apt install git-secrets  # Ubuntu

# Set up for your repo
cd your-project
git secrets --install
git secrets --register-aws
git secrets --add "JWT_SECRET=.*"
git secrets --add "MONGODB_URI=.*"

Now every commit is scanned for secrets. If found, the commit is blocked.

Prevention 3: husky + lint-staged

npm install --save-dev husky lint-staged
npx husky install
npx husky add .husky/pre-commit "npx lint-staged"

// package.json
{
  "lint-staged": {
    "*.js": [
      "node scripts/check-secrets.js"
    ]
  }
}

// scripts/check-secrets.js
const fs = require("fs");
const { execSync } = require("child_process");

const files = process.argv.slice(2);
const secretPatterns = [
  /AKIA[0-9A-Z]{16}/,  // AWS access key
  /mongodb://.*:.*@/,  // MongoDB URI with credentials
  /JWT_SECRET=.{10,}/,  // JWT secret
  /api[_-]?key.{0,10}=.{10,}/i,  // API key
];

let hasSecrets = false;

files.forEach(file => {
  const content = fs.readFileSync(file, "utf-8");
  secretPatterns.forEach(pattern => {
    if (pattern.test(content)) {
      console.error(`Potential secret found in ${file}`);
      hasSecrets = true;
    }
  });
});

if (hasSecrets) {
  console.error("Commit blocked: Potential secrets detected");
  process.exit(1);
}

Prevention 4: GitHub Secret Scanning

GitHub automatically scans for known secret formats (AWS keys, Stripe keys, etc.) and alerts you. Enable in:

• Repository → Settings → Code security and analysis → Secret scanning → Enable

Prevention 5: Environment-based Configuration

Never put secrets in code:

// WRONG
const apiKey = "sk_live_abc123";

// RIGHT
const apiKey = process.env.STRIPE_API_KEY;

What to Do If Secrets Are Committed

Step 1: Rotate the Secret Immediately

The secret is compromised. Generate a new one:

# Generate new JWT secret
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

# Update .env with the new secret
nano .env

Step 2: Remove from Git History

# Remove .env from all commits
git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch .env" \
  --prune-empty --tag-name-filter cat -- --all

# Or use BFG Repo-Cleaner
bfg --delete-files .env
bfg --replace-text passwords.txt
git reflog expire --expire=now --all
git gc --prune=now --aggressive

Step 3: Force Push

git push origin --force --all
git push origin --force --tags

Warning: Force push rewrites history. Coordinate with your team.

Step 4: Audit for Unauthorized Access

• Check AWS CloudTrail for unauthorized API calls
• Check database access logs
• Check application logs for suspicious activity
• Monitor for unusual behavior

Tools for Secret Scanning

The Takeaway

Prevent credential leaks with .gitignore, pre-commit hooks (git-secrets, husky), and GitHub Secret Scanning. Never hardcode secrets always use environment variables. If secrets are committed, rotate them immediately, remove from Git history with git filter-branch or BFG, force push, and audit for unauthorized access.