Gitleaks - Bảo vệ mã nguồn khỏi rò rỉ thông tin nhạy cảm#

1
graph TD
2
    A[Source Input] --> B{Input Type}
3
    B -->|Git Repository| C[Git Log Scanner]
4
    B -->|Directory/Files| D[File System Scanner]
5
    B -->|Stdin| E[Stream Scanner]
6

7
    C --> F[Content Processor]
8
    D --> F
9
    E --> F
10

11
    F --> G[Regex Engine]
12
    G --> H[Pattern Matching]
13
    H --> I{Match Found?}
14

15
    I -->|Yes| J[Entropy Check]
16
    I -->|No| K[Continue Scanning]
17

18
    J --> L{High Entropy?}
19
    L -->|Yes| M[Secret Detected]
20
    L -->|No| K
21

22
    M --> N[Apply Allowlists]
23
    N --> O{In Allowlist?}
24
    O -->|Yes| K
25
    O -->|No| P[Report Finding]
26

27
    K --> Q[Scan Complete]
28
    P --> Q
29

30
    style M fill:#ff6b6b
31
    style P fill:#ff6b6b
32
    style G fill:#4ecdc4
33
    style H fill:#4ecdc4

1
gantt
2
    title Quá trình từ Secret Leak đến Security Incident
3
    dateFormat  YYYY-MM-DD
4
    axisFormat  %m/%d
5

6
    section Development
7
    Dev commit secret          :done, dev1, 2025-01-01, 1d
8
    Code review bỏ qua         :done, dev2, after dev1, 1d
9
    Merge vào main branch      :done, dev3, after dev2, 1d
10

11
    section Discovery
12
    Automated scan phát hiện   :crit, disc1, after dev3, 2d
13
    Manual review              :disc2, after disc1, 1d
14

15
    section Attack
16
    Attacker tìm thấy secret   :crit, attack1, after dev3, 5d
17
    Reconnaissance             :attack2, after attack1, 2d
18
    Initial compromise         :crit, attack3, after attack2, 1d
19
    Data exfiltration          :crit, attack4, after attack3, 3d
20

21
    section Response
22
    Incident detected          :resp1, after attack4, 1d
23
    Emergency response         :crit, resp2, after resp1, 2d
24
    Forensic investigation     :resp3, after resp2, 5d
25
    Recovery & hardening       :resp4, after resp3, 7d

1
graph LR
2
    subgraph "Không có Gitleaks"
3
        A1[Developer] --> B1[Commit Secret]
4
        B1 --> C1[Push to Repo]
5
        C1 --> D1[Deploy to Production]
6
        D1 --> E1[Secret Exposed]
7
        E1 --> F1[Security Breach]
8
        F1 --> G1[Incident Response]
9
        G1 --> H1[Business Impact]
10
    end
11

12
    subgraph "Có Gitleaks"
13
        A2[Developer] --> B2[Commit Secret]
14
        B2 --> C2[Pre-commit Hook]
15
        C2 --> D2{Gitleaks Scan}
16
        D2 -->|Secret Found| E2[Block Commit]
17
        D2 -->|Clean| F2[Allow Commit]
18
        E2 --> G2[Developer Fix]
19
        G2 --> B2
20
        F2 --> H2[Safe Deployment]
21
    end
22

23
    style E1 fill:#ff6b6b
24
    style F1 fill:#ff6b6b
25
    style H1 fill:#ff6b6b
26
    style E2 fill:#ffa726
27
    style H2 fill:#66bb6a

1
name: gitleaks
2
on: [pull_request, push, workflow_dispatch]
3
jobs:
4
  scan:
5
    name: gitleaks
6
    runs-on: ubuntu-latest
7
    steps:
8
      - uses: actions/checkout@v3
9
        with:
10
          fetch-depth: 0
11
      - uses: gitleaks/gitleaks-action@v2
12
        env:
13
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

1
[[rules]]
2
id = "primary-rule"
3
description = "Primary rule requiring auxiliary matches"
4
regex = '''password\s*=\s*['"]([^'"]+)['"]'''
5
secretGroup = 1
6

7
# Required auxiliary rule
8
[[rules.required]]
9
id = "database-context"
10
withinLines = 5
11
withinColumns = 50

1
const fakeApiKey = "fake-key-for-testing"; // gitleaks:allow

1
[[allowlists]]
2
description = "ignore test files"
3
paths = ['''test/.*''', '''spec/.*''']
4
regexes = ['''fake-.*''', '''test-.*''']

1
sequenceDiagram
2
    participant Dev as Developer
3
    participant Git as Git Repository
4
    participant CI as CI/CD Pipeline
5
    participant GL as Gitleaks Scanner
6
    participant Rep as Report System
7
    participant Sec as Security Team
8

9
    Dev->>Git: Push code
10
    Git->>CI: Trigger pipeline
11
    CI->>GL: Run Gitleaks scan
12

13
    alt Secrets found
14
        GL->>Rep: Generate security report
15
        Rep->>Sec: Alert security team
16
        GL->>CI: Fail pipeline
17
        CI->>Dev: Block deployment
18
        Dev->>Dev: Fix secrets
19
        Dev->>Git: Push fixed code
20
    else No secrets
21
        GL->>CI: Pass scan
22
        CI->>CI: Continue deployment
23
    end

1
graph TB
2
    subgraph "Security Gates"
3
        A[Code Commit] --> B[Pre-commit Hook]
4
        B --> C{Gitleaks Check}
5
        C -->|Pass| D[Push to Repository]
6
        C -->|Fail| E[Block Commit]
7
        E --> F[Developer Fix]
8
        F --> B
9

10
        D --> G[CI/CD Trigger]
11
        G --> H[Gitleaks Full Scan]
12
        H --> I{Comprehensive Check}
13
        I -->|Pass| J[SAST/DAST Tests]
14
        I -->|Fail| K[Pipeline Failure]
15

16
        J --> L{All Tests Pass?}
17
        L -->|Yes| M[Deploy to Staging]
18
        L -->|No| N[Security Review]
19

20
        M --> O[Production Gitleaks Scan]
21
        O --> P{Final Security Check}
22
        P -->|Pass| Q[Deploy to Production]
23
        P -->|Fail| R[Emergency Stop]
24
    end
25

26
    style C fill:#ffa726
27
    style I fill:#ffa726
28
    style P fill:#ffa726
29
    style E fill:#ff6b6b
30
    style K fill:#ff6b6b
31
    style R fill:#ff6b6b
32
    style Q fill:#66bb6a

1
name: Security Scan
2
on: [push, pull_request]
3

4
jobs:
5
  gitleaks:
6
    runs-on: ubuntu-latest
7
    steps:
8
      - uses: actions/checkout@v3
9
        with:
10
          fetch-depth: 0
11
      - name: Run Gitleaks
12
        uses: gitleaks/gitleaks-action@v2
13
        env:
14
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

1
pipeline {
2
    agent any
3
    stages {
4
        stage('Security Scan') {
5
            steps {
6
                script {
7
                    docker.image('zricethezav/gitleaks:latest').inside {
8
                        sh 'gitleaks git -v --source . --report-format json --report-path gitleaks-report.json'
9
                    }
10
                }
11
            }
12
            post {
13
                always {
14
                    archiveArtifacts artifacts: 'gitleaks-report.json', fingerprint: true
15
                }
16
            }
17
        }
18
    }
19
}

1
mindmap
2
  root((Gitleaks Detection))
3
    API Keys
4
      AWS Access Key
5
      Google API Key
6
      GitHub Token
7
      OpenAI API Key
8
      Stripe API Key
9
    Database Credentials
10
      MySQL Password
11
      PostgreSQL Connection
12
      MongoDB URI
13
      Redis Password
14
      SQLite Database
15
    Cloud Services
16
      Azure Client Secret
17
      GCP Service Account
18
      Docker Registry
19
      Kubernetes Secrets
20
      Terraform Tokens
21
    Third-party Services
22
      Slack Webhook
23
      Twilio Auth Token
24
      SendGrid API Key
25
      Mailgun API Key
26
      Discord Bot Token
27
    Cryptographic Keys
28
      RSA Private Key
29
      SSH Private Key
30
      GPG Private Key
31
      JWT Secret
32
      Encryption Keys
33
    Generic Patterns
34
      Password Fields
35
      Secret Variables
36
      Auth Headers
37
      Bearer Tokens
38
      Basic Auth

1
graph TD
2
    A[Level 0: Reactive] --> B[Level 1: Basic Protection]
3
    B --> C[Level 2: Integrated Security]
4
    C --> D[Level 3: Advanced Monitoring]
5
    D --> E[Level 4: Automated Response]
6

7
    A1[Manual secret cleanup<br/>Post-incident discovery<br/>No automated scanning] --> A
8
    B1[Pre-commit hooks<br/>Basic CI/CD integration<br/>Default rules] --> B
9
    C1[Custom rules<br/>Multiple scan points<br/>Team training] --> C
10
    D1[Real-time monitoring<br/>Comprehensive reporting<br/>Trend analysis] --> D
11
    E1[Auto-remediation<br/>Zero-trust pipeline<br/>ML-enhanced detection] --> E
12

13
    style A fill:#ff6b6b
14
    style B fill:#ffa726
15
    style C fill:#ffeb3b
16
    style D fill:#8bc34a
17
    style E fill:#4caf50