False positives - currently in pagerDutyApiKey

[shoddyknight]

Please review the Community Note before submitting

TruffleHog Version

3.55.1

Trace Output

Expected Behavior

A standard camelCase string used in coding should not be detected as a secret

Actual Behavior

existingSubscription is detected as a secret

Additional Context

We use trufflehog in CI and output that to a Gitlab native report to generate security reports. Consistent false positives cause our dev teams real headaches and block the path to production

[dxa4481]

Hi @shoddyknight , can you provide more information? We typically only recommend using the --only-verified flag, which would have attempted to authenticate with the PD key. Do you have the raw TruffleHog output? Is it showing up as verified?

[shoddyknight]

Hi, @dxa4481 - we do not currently run with --only-verified and I can confirm this is not showing as verified.

I am adding a line of code to allow us to generate trace reports from the CI pipeline to give the raw output, I can add the raw JSON report shortly

[shoddyknight]

{
  "SourceMetadata": {
    "Data": {
      "Git": {
        "commit": "478b68d2f2be5e4d95718c479e7ce4aa0f031601",
        "file": ".../StopSubscriptionServiceImpl.java",
        "email": "....",
        "repository": "...",
        "timestamp": "2023-09-12 13:45:22 +0000",
        "line": 156
      }
    }
  },
  "SourceID": 1,
  "SourceType": 16,
  "SourceName": "trufflehog - git",
  "DetectorType": 32,
  "DetectorName": "PagerDutyApiKey",
  "DecoderName": "BASE64",
  "Verified": false,
  "Raw": "existingSubscription",
  "RawV2": "",
  "Redacted": "",
  "ExtraData": null,
  "StructuredData": null
}

[dxa4481]

You're going to experience a lot of unverified false positives, but the verification feature should sort them all out for you. Are you able to enable that flag?

[dxa4481]

Here's a related short blog: https://trufflesecurity.com/blog/its-impossible-to-find-every-vulnerability-so-we-dont-try-to/

[shoddyknight]

I'll share this with my SecDev colleagues and we can discuss, thanks

I still think the bug is quite unpleasant

[bugbaba]

Also, The recent surge is due to the recent change #1749 that added pd as keyword and since its so small/common its getting triggered more.

[Marx314]

You're going to experience a lot of unverified false positives, but the verification feature should sort them all out for you. Are you able to enable that flag?

so you're telling me I must leak information to every service in order to test if there is a valid token?

3.59.0 on 1000 repository I ended with

As we don't use pagerduty (or exchange rate api) I simply discard does result. Is there a way to deactivate some detectors via config or cli?

[rgmz]

As we don't use pagerduty (or exchange rate api) I simply discard does result. Is there a way to deactivate some detectors via config or cli?

That should be possible with --exclude-detectors

https://github.com/trufflesecurity/trufflehog/blob/98d2922bee11002ae67b9cd4e900a9d685b8596f/main.go#L64