write and publish detection rules for open source tools in a separate repo

[commjoen]

• get a repo organized with github actions, etc..
• pick up the first secret from the testbed (create a secrets detection testbed branch with revoked credentials #201) to write rules/config for for both tools. best would be to take one you are very familiar with from the list in that issue (e.g. you can smell/recognize the credential for miles away 😄 )
• setup a test suite to see if the tool(git-secrets/trufflehog/detect-secrets) using the rule detects exactly that and not too much (e.g. very low false positive ratio)
• make sure we have a github action to fire the rule suite, linters, etc.
• rinse and repeat for other secrets in testbed (e.g. create rules and detection tests, with possible separate issues in another git repo)

[commjoen]

this could be for https://github.com/Yelp/detect-secrets as well aaaand we might need base64 encoded/ hex encoding stuff as well?

[mackowski]

I will help with that

[mack-droid]

I am in for contribution.

[su-muskan]

I am up for the task

[commjoen]

Awesome! Assigned it to all 3 of you :) welcome to the team!

[commjoen]

Decisions to be tackled:

• one tool (if so which?) versus all 3 tools in scope of this issue
• any other tool to extend?
• repos: commjoen, wrongsecrets-orga, owasp (prefered wrongsecrets-orga for now)

[commjoen]

Given nothign really came out of this, I am closing this issue and generating a new one with fresh assisgnment slot and hacktoberfest possibility.