HackBlue

Tools · Workbench

Secrets and dependency scanning

Lessons on gitleaks, TruffleHog, Semgrep, Trivy, and Grype: finding leaked keys, risky code patterns, and vulnerable packages in your repositories and images.

  • 6 lessons
  • 1 h of reading
  • 5 topics
Start with lesson 1All workbenches

A scanner is only useful when its output reaches someone who can fix it. These lessons cover running each tool, reading one finding precisely, deciding what blocks a merge, and recording accepted risk where reviewers can see it.

Scan repositories, images, and build output your team owns. When a secret turns up, revoke it before anything else.

gitleaks

1 lesson

  1. 01gitleaks: scan repository history and block secrets at commit timeScan a repository’s full git history with gitleaks, read a redacted finding, record accepted false positives by fingerprint, and add a pre-commit check so new keys never land.11 min

TruffleHog

1 lesson

  1. 01TruffleHog: find verified secrets across your organization’s repositoriesScan your GitHub organization and build artifacts with TruffleHog, use credential verification to rank live secrets first, and decide when verification calls are not allowed.11 min

Semgrep

2 lessons

  1. 01Semgrep in CI: scan only new code and triage the first findingsRun Semgrep with a curated ruleset in a pull-request job, use a baseline commit so only new findings fail the build, and triage the first results with the team that owns the code.11 min
  2. 02Writing a Semgrep rule for your codebase, with testsWrite a Semgrep rule for a mistake specific to your own code, add ruleid and ok test annotations, and run semgrep --test so the rule stays correct as it evolves.12 min

Trivy

1 lesson

  1. 01Trivy: gate container images and Terraform in one pipeline stepUse Trivy to scan a built image for fixable high-severity vulnerabilities, scan Terraform for misconfigurations, and fail CI only on findings the team has agreed to block.11 min

Grype

1 lesson

  1. 01Grype on stored SBOMs: catch new CVEs in images you already shippedGenerate an SBOM with Syft at release time, then rescan it daily with Grype so vulnerabilities published after the release reach the owning team without rebuilding the image.10 min