validity checking of detected secrets ? about detect-secrets HOT 5 CLOSED

@Gby56 detect-secrets does do secret verification: https://github.com/Yelp/detect-secrets/blob/master/docs/plugins.md#Verified-Secrets
Not all the plug-ins have implemented it, not as many as Trufflehog, but it wouldn't be very difficult for people to add more; the plugin framework supports it.

from detect-secrets.

Hi @Gby56, could you please explain what you mean by "validity checking of detected secrets"?

from detect-secrets.

Hi ! Something like Trufflehog's checks, most of them seem to be pure HTTP requests to use the token and see if it's still valid
https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/slack/slack.go#L91

from detect-secrets.

Thank you @gpflaum for helping out answering this issue :)

from detect-secrets.

Thank you both ! :)

from detect-secrets.