WeAreDevelopers LIVE • Apr 27, 2023

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

Once an API key enters your Git history, it stays there forever. Discover how pre-commit hooks can automatically block hard-coded secrets before they ever leave your local terminal.

Pause

Mute

Enter Fullscreen

#1 about 6 min

Real world incidents of hardcoded credential software leaks

High-profile data breaches showcase how exposed credentials compromise otherwise secure networks.

#2 about 5 min

The mechanics of accidental credential exposure in commits

Fast-paced debugging and temporary test variables inadvertently cause millions of public credential leaks.

#3 about 3 min

Shifting security responsibility into modern developer workflows

Integrating native security checks directly into code repositories addresses the ratio imbalance between engineering and security teams.

#4 about 8 min

How Git architecture fundamentally exposes historical code secrets

Understanding Git's snapshot architecture reveals why reverted secrets remain vulnerable inside the hidden commit tree.

#5 about 4 min

Best practices for ignoring and securely vaulting secrets

Employing environment files and encrypted key stores properly keeps sensitive credentials out of version control.

#6 about 2 min

The pipeline cost of removing leaked git commits

Surgically removing exposed credentials from a shared repository creates complex pipeline and team coordination issues.

#7 about 6 min

Automating local security checks using native Git hooks

Implementing automated pre-commit checks leverages local Git functionality to immediately block insecure commits.

#8 about 4 min

Building a custom bash script to detect secrets

Custom shell scripts utilize regular expressions to efficiently prevent specific credential patterns from entering repositories.

#9 about 6 min

Evaluating open source secret detection tools for developers

Community resources like git-secrets and TruffleHog provide robust automated pre-commit scanning capabilities without heavy deployment overhead.

#10 about 4 min

Preventing credential leaks seamlessly at commit time

Identifying sensitive data locally halts security incidents before they disrupt broader continuous integration environments.

#11 about 7 min

Engaging with open source tech communities through documentation

Contributing documentation and providing non-code support offer valuable entryways for engaging with open source software organizations.

#12 about 8 min

Measuring hook effectiveness and alternative secret management tools

Tracking stopped commits demonstrates enforcement success while universal vault managers streamline broader secret oversight processes.

Matching moments

6:14 min

Introduction to securing secrets in GitOps deployments

Alex Soto

Alex Soto · LIVE

1:36 min

Protecting source code repositories and developer credentials

Niels Tanis

Niels Tanis · World Congress 2022

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

2:58 min

Auditing existing codebases with secret scanning risk assessments

Kevin Lewis

Kevin Lewis · World Congress 2025

1:58 min

Embedding continuous security practices into standard developer workflows

Kevin Lewis

Kevin Lewis · World Congress 2025

1:21 min

Maintaining anonymity and operational security in open source

Johan Hutting

Johan Hutting · World Congress 2024

More from WeAreDevelopers LIVE

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail

about 1 month ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen

World Congress 2026 North America

September 25, 2026 · 12:30–14:30

Stage 11

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Front-End Advocate | Speaker | AI & DevOps | Docker Captain | Cursor Ambassador | DevReal | Tech Blogger | Book Author

Kristiyan Velkov

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma

World Congress 2026 North America

September 25, 2026 · 09:00–09:30

Stage 4

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans

World Congress 2026 North America

September 25, 2026 · 13:30–14:00

Stage 9

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy

Related videos

Securing Secrets in the GitOps era thumbnail

LIVE • over 3 years ago

Securing Secrets in the GitOps era

Alex Soto

Best Practices for Using GitHub Secrets thumbnail

LIVE • almost 2 years ago

Best Practices for Using GitHub Secrets

Marcel Lupo

Securing secrets in the GitOps Era thumbnail

LIVE • over 2 years ago

Securing secrets in the GitOps Era

Davide Imola

Real-World Security for Busy Developers thumbnail

World Congress 2025 • about 1 year ago

Real-World Security for Busy Developers

Kevin Lewis

Supply Chain Security and the Real World: Lessons From Incidents thumbnail

World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Why Git Still Matters thumbnail

World Congress 2026 Europe • 2 months ago

Why Git Still Matters

PJ Hagerty

Related articles

DC

Daniel Cranney

The Overflow: 5 Security and Privacy Tools for Developers

We’re back again with another edition of the Overflow, where we share some of the best tools we’ve found from around the web that we just couldn’t cram into the already jam-packed editions of the D...

5 months ago

A laptop with a padlock chained around it

CH

Chris Heilmann

Stop Googling Git Commands. Start Actually Learning Git.

Every developer has been there. You’re mid-flow, about to push a feature branch, and you need to undo your last three commits without blowing up the remote history. So you do what you always do: yo...

4 months ago

The Git Skills homepage showing you quizzes and how-tos.

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

DC

Daniel Cranney

Dev Digest 214: Claude Is Leaking, GitHub Is Listening & Axios Hacked!

Inside last week’s Dev Digest 214 . 🕵️ Claude source code leaked, analysed and re-written in 2 days 🐙 GitHub auto-opts users into feeding their code to train their AI 🌐 Pretext shows how to show c...

5 months ago

From learning to earning

Jobs that call for the skills explored in this talk.

about 1 month ago

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases

9 days ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

16 days ago • Verified

Founding Developer Advocate

San Francisco, United States

Experienced €150k–190k Remote GIT Bash Linux

9 days ago • Verified

Manager, Engineering, Secure Build and SCS Services

Expert Remote Team Leadership

9 days ago • Verified

Senior Software Engineer, Secure Build

Expert Remote Go

9 days ago • Verified

Senior Principal Software Engineer, Docker and Ecosystem

Seattle, United States

Expert Remote Cloud (AWS/Google/Azure)