Secret scan hooks

The git hooks from stashbase scan install check commits and pushes for hard-coded secrets. They also work when an agent commits or pushes from inside stashbase agent run. The agent never gets your API key: the scan runs on your machine through the Agent Proxy, and findings block the commit or push just as they do outside the sandbox.

Enable secret scanning

Add secret_scan to the profile's allow_hooks list:

allow_hooks = ["secret_scan"]

It can be combined with dependency checking:

allow_hooks = ["dependency_check", "secret_scan"]

Then install the git hooks in the repository as usual:

stashbase scan install pre-commit
stashbase scan install pre-push

If you installed the hooks before this feature was available, run stashbase scan install again to update them. Without secret_scan in the profile, the hook fails inside the sandbox and tells you what to add.

Differences from local scans

Because the agent can edit the repository, a few things work differently:

• The match and output-dir settings in stashbase-scan.yaml are ignored. excluded-files and ignored-secrets still apply.
• Very large changes can't be scanned this way. Commit them from outside the sandbox.
• The scan can read only the run's repository, so the agent can't use it to reach other files on your machine.

Requirements

• macOS or Linux. On Linux, bubblewrap (bwrap) must be installed. Where this isn't available, including Windows, stashbase agent validate reports it and the run doesn't start.
• curl in the sandbox. The default Docker image includes it.

See CLI scans for the scan configuration file and Profile configuration for the rest of the profile.