Securing Your Git Repositories

This chapter discusses the likelihood of developers accidentally pushing sensitive tokens, certificates, access keys, and passwords into code repositories and why monitoring their repositories is critically important to avoid unwelcome compromises. It focuses on two popular Open Source tools, which appear, using default settings, to have differing scanning abilities. These are, Gitleaks and GitRob. There are a few prerequisites to consider when setting up developer's code repositories for security. The first is that they need to make sure the hosting of their code repository is secure and suitable for their needs. In true Cloud Native form, developers will opt for the Docker method to run Gitleaks by using the provided container image. GitRob is possibly the first Open Source tool that springs to mind when people think about scanning code repositories.