microsoftgraph
CredScan as a pre-commit git hook
Should this be called "CredScan as a PR gate" instead? As far as I understand, pre-commit hook is a dev setup thing. Unless this issue refers to something else that I am not aware of..
cc: @MIchaelMainer
PR is too late, secrets are already pushed to public, threat actors may have already consumed them. This is a dev setup thing. Now to think of it, not really a work item JS repo.
@MIchaelMainer we are adding it as a gate too in Raptor in case the secrets slip through from the dev setup: https://github.com/microsoftgraph/msgraph-sdk-raptor/pull/955.
Yes, as a gate, that's good. I still want everyone running CredScan locally. ☺️
I'd say yes. One is to prevent it from happening, the other is to catch if it happens. I think we have a way to catch it after the check-in by default security scanning tools, but the earlier we catch, the better.
That said, as @MIchaelMainer said, "pre-commit hook" is not really a work item specific to the repo.