The newest Secrets & Credential Leaks resources are on the Secrets & Credential Leaks page. For a reading order instead of a date order, see the Secrets & Credential Leaks learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-06 2026 | Hardcoded Secrets in AI-Generated Code: Catch Them Before They Ship intermediate 6 min read | Toolset offering a defensive strategy against hardcoded secrets in AI-generated code, specifically addressing CWE-798. This approach leverages Gitleaks for pre-commit hook protection, preventing secrets from entering repositories, and TruffleHog for deep scanning of git history, S3 buckets, and CI/CD logs with credential verification. The article highlights common AI patterns for leakage, such as inline credentials, client-side bundle leaks, and un-ignored .env files, and emphasizes the importance of these tools for mitigating risks like those seen in the Moltbook incident. |
| 2026-04-03 2026 | AWS Secrets Manager vs HashiCorp Vault [2026] beginner 6 min read | Comparison of AWS Secrets Manager and HashiCorp Vault analyzes their strengths and weaknesses for enterprise secret management. It highlights differences in secrets storage, access control via IAM versus Vault's policies, and ecosystem integrations. The analysis also touches on scalability, audit capabilities, and user experience, noting Vault's shift to a source-available license and the implementation complexities of both solutions, contrasting them with Infisical's developer-focused open-source alternative. |
| 2026-04-03 2026 | AWS Secrets Engine | HashiCorp Vault beginner 15 min read | Library for dynamically generating AWS credentials. This secrets engine creates IAM users, assumes roles, or generates federation and session tokens based on defined Vault roles. It supports creating short-lived, time-bound credentials automatically revoked upon lease expiration, offering an alternative to static IAM user management. Configuration involves enabling the engine, setting root AWS credentials for Vault's communication, and defining Vault roles that map to AWS IAM policies and credential types. |
| 2026-04-03 2026 | Researcher Unearths Thousands of Leaked Secrets in GitHub's "Oops Commits" news 2 min read | Tool, Force Push Scanner, identifies and scans orphaned Git commits for leaked secrets, including GitHub PATs and AWS credentials. Developed by Truffle Security and Sharon Brizinov, this open-source utility leverages GH Archive data and TruffleHog scanning to uncover sensitive information like MongoDB credentials and API tokens potentially exposed in force-pushed or deleted commits, mitigating supply-chain attack risks. → infoq.com |
| 2026-04-03 2026 | How to Detect and Clean Up Leaked Secrets in Your Git Repositories intermediate 5 min read | Guide on detecting and cleaning leaked secrets in Git repositories. It details using tools like Gitleaks and Trufflehog for detection, and BFG Repo-Cleaner for historical cleanup, emphasizing the importance of backups due to the destructive nature of history manipulation. |
| 2026-04-03 2026 | Secret Scanning Tools 2026: Protect Code and Prevent Credential Leaks beginner 16 min read | Library for detecting and preventing secret leaks in code, offering continuous scanning, broad detector coverage for AWS, GCP, Azure, and internal tokens, and integration with GitHub, GitLab, and Slack. It utilizes pattern matching, entropy detection, and context-aware validation, with machine learning to reduce false positives and dedicated remediation workflows to address detected issues across the software development lifecycle. → blog.gitguardian.com |
| 2026-04-03 2026 | Why 28 Million Credentials Leaked on GitHub in 2025 | Snyk news 17 min read API Sec | Library for detecting and preventing leaked secrets, including API keys, database passwords, cloud IAM credentials, and AI service keys. It addresses accidental commits to Git, insecure .env file practices, supply chain attacks via malicious packages like Shai-Hulud and compromised versions of TruffleHog, and leaks through non-code surfaces such as Slack, Jira, and Docker Hub. The library also highlights the growing risk from AI-assisted development and MCP server credentials, differentiating its secret scanning capabilities from SAST tools by emphasizing the analysis of full Git history, including deleted files. → snyk.io |
| 2026-04-03 2026 | Gitleaks - Find Secrets with Gitleaks beginner 14 min read | Tool for detecting secrets like passwords, API keys, and tokens in git repos, files, and via stdin. Gitleaks supports scanning via `git`, `dir`, and `stdin` commands, and can be integrated as a pre-commit hook or GitHub action. It allows for baseline scanning to ignore old findings and custom rule configuration. |
| 2026-04-03 2026 | TruffleHog - Find, Verify, and Analyze Leaked Credentials beginner 14 min read | Tool for discovering, classifying, validating, and analyzing leaked credentials. TruffleHog scans Git, Jira, Slack, Confluence, Microsoft Teams, SharePoint, S3 buckets, GCS, and Docker images for over 800 secret types, including API keys and database passwords. It can verify if secrets are live and enrich findings by determining resource access and permissions. TruffleHog includes protections against malicious Git configurations, addressing CVE-2025-41390. |
| 2026-04-03 2026 | Secrets Management - OWASP Cheat Sheet Series beginner 40 min read | Cheatsheet outlining best practices for secrets management, crucial for DevOps environments. It covers high availability, centralization and standardization of secret storage, fine-grained access control based on the Least Privilege principle, and automation of secret management through pipelines, dynamic secrets, and automated rotation. Architectural patterns are illustrated with examples like Kubernetes sidecar containers for HashiCorp Vault and serverless functions for AWS Secrets Manager. → cheatsheetseries.owasp.org |
| 2026-03-02 2026 | Breaking the Trust Boundary: SSRF via a Misconfigured Sentry Tunnel intermediate SSRF | Free Article Link: Click for free! → infosecwriteups.com |
| 2026-02-02 2026 | depthfirst | 1-Click RCE To Steal Your Moltbot Data and Keys advanced 5 min read AI RCE | Analysis of CVE-2026-25253 in OpenClaw details a 1-click RCE exploit achieved by chaining a logic flaw in gateway URL ingestion with Cross-Site WebSocket Hijacking (CSWSH). The vulnerability allows an attacker to steal authentication tokens, bypass localhost restrictions, disable security features like user confirmations and sandboxing via API calls, and execute arbitrary commands on the victim's machine. |
| 2025-08-24 2025 | GitHub - dele-to/dele-to: Share sensitive credentials and secrets securely with client-side AES-256 encryption, zero-knowledge architecture, and automatic self-destruction. beginner 6 min read | Library for securely sharing sensitive credentials and secrets, DELE.TO employs client-side AES-256-GCM encryption and a zero-knowledge architecture, ensuring encryption keys never reach the server. It features automatic self-destruction through configurable expiration times and view limits, offering an alternative to tools like PasswordPusher and Bitwarden Send. |
| 2025-03-10 2025 | GitHub - vsec7/BurpSuite-Xkeys: A Burp Suite Extension to extract interesting strings (key, secret, token, or etc.) from a webpage. intermediate Burp | Extension for Burp Suite that passively scans webpages to extract interesting strings like keys, secrets, and tokens. It lists these findings as information issues and can be configured by adding the Python script through the Extender tab after setting up the Jython environment. The extension identifies assets and displays results in the issues box and extender output, supporting various key-value pair formats. |
| 2025-03-08 2025 | GitHub - trufflesecurity/trufflehog-burp-suite-extension: Official TruffleHog Burp Suite Extension. Scan Burp Suite traffic for 800+ different types of secrets (API keys, passwords, SSH keys, etc) using TruffleHog. intermediate 2 min read Burp | Extension for Burp Suite that scans HTTP traffic for over 800 types of secrets, including API keys, passwords, and SSH keys, leveraging TruffleHog. It operates by writing traffic to temporary files and invoking TruffleHog scans every 10 seconds, reporting findings in a dedicated tab. The extension supports secret verification and can be configured to scan various Burp Suite traffic sources. |
| 2024-10-24 2024 | Cryptography — The Hitchhiker's Guide to Python beginner 2 min read Python | Library for Python cryptography, offering a high-level `Fernet` symmetric encryption recipe and low-level "hazmat" primitives. Includes GPGME Python bindings for access to the GNU Privacy Guard suite, supporting encryption and decryption using GPG and S/MIME engines. Examples demonstrate generating keys, encrypting and decrypting messages, and file encryption. |
| 2024-09-11 2024 | Browser Stored Credentials beginner 8 min read | Library for harvesting credentials from browsers, focusing on T1555.003. It details how modern browsers like Chrome and Edge utilize DPAPI for encrypting user credentials and outlines the file locations for storing this sensitive data. The library discusses tools like Lazagne, SharpChrome, and DonPAPI, emphasizing that detection should focus on the behavior of processes accessing credential files and the CryptUnprotectData API, rather than signature-based methods. It provides a playbook for purple teams to emulate this technique and assess SOC detection capabilities. → ipurple.team |
| 2024-08-27 2024 | Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All news 6 min read OSINT | Writeup detailing researcher Bill Demirkapi's methods for discovering thousands of hard-coded developer secrets, including API keys and credentials for entities like Nebraska's Supreme Court and Stanford University, by leveraging VirusTotal's Retrohunt feature and YARA rules. The writeup also covers his identification of 66,000 websites with dangling subdomain issues, which could lead to hijacking and other attacks, using passive DNS replication data. Demirkapi developed an automated revocation process for exposed secrets, notably with OpenAI's assistance. → wired.com |
| 2023-11-08 2023 | maxgoedjen/secretive beginner 2 min read | Library for securing SSH private keys using macOS Secure Enclave and Touch ID, preventing export and enabling authenticated access. It also supports Smart Cards like YubiKeys for Macs lacking Secure Enclaves, and provides access notifications. Builds are attested via GitHub Artifact Attestation, and Secretive relies on Keychain APIs for key management, requiring consistent bundle IDs for successful access. Secrets stored in the Secure Enclave are non-exportable, necessitating recreation on new machines. |
| 2023-09-06 2023 | Results of Major Technical Investigations for Storm-0558 Key Acquisition news AuthN | Analysis of Storm-0558 key acquisition detailing Microsoft's technical investigations, security program updates, policy changes, and strategic guidance. This entry highlights perspectives from researchers and security teams focused on protecting customers. |
| 2023-08-22 2023 | OWASP/wrongsecrets beginner 18 min read | Game challenging users to find intentionally hidden secrets within code, configuration files, Docker containers, and cloud deployments. It provides over 65 real-world examples of common secrets management mistakes, including exposed credentials in Spring Boot applications, and offers online and local Docker-based setups. Advanced users can explore Kubernetes and cloud challenges, utilizing tools like Minikube and cloud accounts for practical learning. |
| 2023-08-05 2023 | How To Keep A Secret in Python Apps intermediate 67 min read Python | Library for managing secrets in Python applications, emphasizing that hard-coding credentials like API keys and database passwords in source code is a major security risk. It highlights the `keyring` Python library for secure OS-native storage, the importance of threat modeling, and suggests tools like password managers, PinPal for memorization, and macOS Keychain for user-prompted secret access. The library also touches on secure CI/CD practices with GitHub Actions secrets and the fundamental need for local machine security through disk encryption. |
| 2022-03-17 2022 | Favorite tweet by @0x1shu beginner Bug Bounty | Favorite tweet: 🧙♂️Git Secrets Leaks Simplified by @sec_r0 ✨ In this flyer, you'll learn about how git works and the reason behind the git secrets leaks. Download the flyer: https://t.co/zMruBpl6c4 ... |
| 2022-01-15 2022 | Source Code Disclosure via Exposed .git Folder intermediate | Source Code Disclosure via Exposed .git Folder |
| 2021-10-14 2021 | Finding Sensitive Data Leaks In Code Using ShiftLeft CORE intermediate | Finding Sensitive Data Leaks In Code Using ShiftLeft CORE |
| 2021-10-10 2021 | New CS proposal: Avoiding password and sensitive shared data transmission #685 beginner 2 min read AuthN | Cheatsheet proposal addressing secure password and sensitive data transmission by leveraging HMAC. This approach allows users to authenticate without sending passwords to the server, mitigating transmission-related attacks. The objective is to educate developers that passwords need only be handled on the client-side for authentication verification, with the server only involved during initial password setup for secure hashing and storage. This method avoids the need for server-side password processing in many use cases, referencing IETF RFC 2104. |
| 2021-09-20 2021 | TruffleHog The Chrome Extension beginner 2 min read | Tool for detecting API keys and other secrets like `.git` directories and `.env` files within JavaScript code and client-side applications. It leverages permissive CORS headers from services like AWS to identify instances where credentials might be inadvertently exposed, as demonstrated by an example on weather.com. The extension can be side-loaded while awaiting review on the Google Extension Store. → trufflesecurity.com |
| 2021-08-24 2021 | The last S3 security document that well ever need and how to use it beginner 4 min read | ThreatModel for Amazon S3 is an open-source document detailing customer responsibilities for securing AWS's Simple Storage Service. This comprehensive 160-page resource, available on GitHub, helps security architects, DevOps teams, and governance specialists navigate the complexities of S3 security. It provides prioritized control implementation lists, feature class analysis with data flow diagrams, compliance mapping to frameworks like PCI DSS, and guidance for large enterprise onboarding and risk tolerance assessments, aiming to reduce security incidents. |
| 2021-06-21 2021 | 0 : 2 Secrets Management 05202021.pptx beginner | This presentation, titled "Secrets Management," from May 20, 2021, likely covers strategies and best practices for securely managing sensitive information like API keys, passwords, and certificates within an organization. Key topics would probably include identifying what constitutes a "secret," common vulnerabilities, and methods for protecting these secrets throughout their lifecycle, from creation to rotation and eventual destruction. The goal is to prevent unauthorized access and data breaches by implementing robust secrets management solutions. |