WeAreDevelopers LIVE • Apr 27, 2023

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

Once an API key enters your Git history, it stays there forever. Discover how pre-commit hooks can automatically block hard-coded secrets before they ever leave your local terminal.

Pause

Mute

Enter Fullscreen

#1 about 6 min

Real world incidents of hardcoded credential software leaks

High-profile data breaches showcase how exposed credentials compromise otherwise secure networks.

#2 about 5 min

The mechanics of accidental credential exposure in commits

Fast-paced debugging and temporary test variables inadvertently cause millions of public credential leaks.

#3 about 3 min

Shifting security responsibility into modern developer workflows

Integrating native security checks directly into code repositories addresses the ratio imbalance between engineering and security teams.

#4 about 8 min

How Git architecture fundamentally exposes historical code secrets

Understanding Git's snapshot architecture reveals why reverted secrets remain vulnerable inside the hidden commit tree.

#5 about 4 min

Best practices for ignoring and securely vaulting secrets

Employing environment files and encrypted key stores properly keeps sensitive credentials out of version control.

#6 about 2 min

The pipeline cost of removing leaked git commits

Surgically removing exposed credentials from a shared repository creates complex pipeline and team coordination issues.

#7 about 6 min

Automating local security checks using native Git hooks

Implementing automated pre-commit checks leverages local Git functionality to immediately block insecure commits.

#8 about 4 min

Building a custom bash script to detect secrets

Custom shell scripts utilize regular expressions to efficiently prevent specific credential patterns from entering repositories.

#9 about 6 min

Evaluating open source secret detection tools for developers

Community resources like git-secrets and TruffleHog provide robust automated pre-commit scanning capabilities without heavy deployment overhead.

#10 about 4 min

Preventing credential leaks seamlessly at commit time

Identifying sensitive data locally halts security incidents before they disrupt broader continuous integration environments.

#11 about 7 min

Engaging with open source tech communities through documentation

Contributing documentation and providing non-code support offer valuable entryways for engaging with open source software organizations.

#12 about 8 min

Measuring hook effectiveness and alternative secret management tools

Tracking stopped commits demonstrates enforcement success while universal vault managers streamline broader secret oversight processes.

Matching moments

6:14 min

Introduction to securing secrets in GitOps deployments

Alex Soto

Alex Soto · LIVE

1:36 min

Protecting source code repositories and developer credentials

Niels Tanis

Niels Tanis · WWC 2022

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

2:58 min

Auditing existing codebases with secret scanning risk assessments

Kevin Lewis

Kevin Lewis · WWC 2025

1:58 min

Embedding continuous security practices into standard developer workflows

Kevin Lewis

Kevin Lewis · WWC 2025

1:21 min

Maintaining anonymity and operational security in open source

Johan Hutting

Johan Hutting · WWC 2024

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail

about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar

World Congress 2026 North America

GitHub’s Team X-Ray: Your Repository Knows More About Your Team Than Your Team Does

Andrea Griffiths

Senior Developer Advocate

Andrea Griffiths

Related videos

Securing Secrets in the GitOps era thumbnail

LIVE • over 3 years ago

Securing Secrets in the GitOps era

Alex Soto

Best Practices for Using GitHub Secrets thumbnail

LIVE • almost 2 years ago

Best Practices for Using GitHub Secrets

Marcel Lupo

Securing secrets in the GitOps Era thumbnail

LIVE • over 2 years ago

Securing secrets in the GitOps Era

Davide Imola

Real-World Security for Busy Developers thumbnail

WWC 2025 • 12 months ago

Real-World Security for Busy Developers

Kevin Lewis

Supply Chain Security and the Real World: Lessons From Incidents thumbnail

WWC 2025 • 12 months ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Why Git Still Matters thumbnail

WWC Europe 2026 • about 1 month ago

Why Git Still Matters

PJ Hagerty

Related articles

DC

Daniel Cranney

The Overflow: 5 Security and Privacy Tools for Developers

We’re back again with another edition of the Overflow, where we share some of the best tools we’ve found from around the web that we just couldn’t cram into the already jam-packed editions of the D...

4 months ago

A laptop with a padlock chained around it

CH

Chris Heilmann

Stop Googling Git Commands. Start Actually Learning Git.

Every developer has been there. You’re mid-flow, about to push a feature branch, and you need to undo your last three commits without blowing up the remote history. So you do what you always do: yo...

3 months ago

The Git Skills homepage showing you quizzes and how-tos.

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

DC

Daniel Cranney

Dev Digest 214: Claude Is Leaking, GitHub Is Listening & Axios Hacked!

Inside last week’s Dev Digest 214 . 🕵️ Claude source code leaked, analysed and re-written in 2 days 🐙 GitHub auto-opts users into feeding their code to train their AI 🌐 Pretext shows how to show c...

4 months ago

From learning to earning

Jobs that call for the skills explored in this talk.

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases

Senior Software Engineer

AMSTERDAM, Netherlands

Expert Remote Ruby Golang Prolog

Principal Software Engineer, Identity

Expert Remote Ruby OAuth OpenID

Principal Product Manager, Agent Platform

Expert Remote Github Programming Tools Software Engineering

Engineer, Offensive Security Organization

Delhi, NY, United States

Expert Remote Nmap Twilio Ethereal

Software Engineer II, Security

$221k Remote Okta Ruby OAuth