Offensive security assessments
Secret Scanning and Dependency Cheatsheet
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
gitleaks detect --source . --report-format json --report-path gitleaks.json gitleaks detect --source . --log-opts="--all" all branches/history
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- grep -rIEn '(AKIA[0-9A-Z]{16}|ghp[0-9A-Za-z]{36}|-----BEGIN [A-Z ]PRIVATE KEY-----|xox[baprs]-)' .
- cat .gitlab-ci.yml Jenkinsfile .circleci/config.yml 2/dev/null
- npm audit --production pip-audit -r requirements.txt osv-scanner -r
- multi-ecosystem (Google OSV) trivy fs --scanners vuln,secret,misconfig .
- -o cyclonedx-json sbom.json grype sbom:sbom.json vulns from the SBOM
- Long-lived cloud keys, tokens, or private keys committed anywhere in history (rotation needed, not just deletion).
- pullrequesttarget running untrusted PR code with access to secrets.
- Pipelines that run unpinned third-party actions/images (@main instead of a pinned SHA).
What we look for
- grep -rIEn '(AKIA[0-9A-Z]{16}|ghp[0-9A-Za-z]{36}|-----BEGIN [A-Z ]PRIVATE KEY-----|xox[baprs]-)' .
- cat .gitlab-ci.yml Jenkinsfile .circleci/config.yml 2/dev/null
- npm audit --production pip-audit -r requirements.txt osv-scanner -r
- multi-ecosystem (Google OSV) trivy fs --scanners vuln,secret,misconfig .
- -o cyclonedx-json sbom.json grype sbom:sbom.json vulns from the SBOM
- Long-lived cloud keys, tokens, or private keys committed anywhere in history (rotation needed, not just deletion).
- pullrequesttarget running untrusted PR code with access to secrets.
- Pipelines that run unpinned third-party actions/images (@main instead of a pinned SHA).