DevSecOps › Module 4 › Lesson 2
Gitleaks Named
Gitleaks named literacy covers secret pattern detection, pre-commit hooks, and history scans — map secrets scanning on YOUR $DEVSEC_LAB before pushing credentials.
Visual · t36_gitleaks_named
Gitleaks named literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Secrets in Git history never fully disappear — literacy teaches Gitleaks patterns so you scan YOUR repos before merge, not harvest stranger org tokens.
Gitleaks and similar tools regex-scan commits for AWS keys, GitHub PATs, private keys, and API tokens. Pre-commit hooks block local commits; CI scans full history on YOUR repo; allowlists mark test fixtures as safe. A leaked PAT in lab repo still teaches rotation — never paste live production secrets into notes. Cyberlium writes Gitleaks row on YOUR $DEVSEC_LAB — hook placement, scan scope, allowlist rule for one fictional repo. Next: Secret Hygiene.
1. Gitleaks components (named)
Patterns: AWS AKIA, GitHub ghp_, PEM private keys, generic API token formats. Placement: pre-commit locally, CI on push/PR on YOUR repo. Allowlist: fingerprint comments for intentional test secrets in lab fixtures. Remediation: rotate credential, rewrite history only with team approval.
On $DEVSEC_LAB, write Gitleaks row — scan stage, pattern example, allowlist note for fictional repo.
Command guide
Try these commands — Gitleaks components (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: Bridgecrew Checkov (https://www.checkov.io/); Checkov AWS checks (https://www.checkov.io/5.Policy%20Index/terraform.html); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why secrets scanning beats manual grep
Developers commit secrets accidentally in config files and tests. History scans catch secrets removed in later commits but still in Git objects. Lab repos practice hook discipline before production adopts org-wide secret scanning.
Students document lab Gitleaks config on notes — production follows vault integration and automated rotation.
3. Lab boundary
Forbidden: harvesting secrets from stranger org repos or public dumps. Allowed: Gitleaks named card — scan stages with $DEVSEC_LAB fictional placeholders only.
Ship: Gitleaks named card for YOUR lab repo. Next: Secret Hygiene.
4. What you ship: Gitleaks named card for $DEVSEC_LAB
Scan stages, pattern example, allowlist rule. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Gitleaks named card. $DEVSEC_LAB named. File t36-m04-l02-gitleaks-named.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paste live AWS key into lab repo 'for testing.' Scan stranger org for exposed tokens.
Right
Write Gitleaks named card for YOUR $DEVSEC_LAB. Next: Secret Hygiene.
Mission: map Gitleaks on YOUR lab repo
1) Define pre-commit and CI scan stages. 2) Write one pattern example and allowlist rule. 3) Confirm no live production secrets in notes. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Use placeholder secrets in lab fixtures — rotate anything real immediately.
Knowledge Check
APPLY: Gitleaks primarily detects:
Multiple choice
Knowledge Check
APPLY: True or False: Pre-commit hooks can block local secret commits on YOUR repo.
True or False
Knowledge Check
APPLY: Gitleaks literacy on Cyberlium uses:
Multiple choice