Unclear: are commit messages audited too?

[gitleaks]

Unclear: are commit messages audited too?

[zricethezav]

negative, they are not

[keirans]

Interesting this came up, I was thinking about this last week, having a set of patterns that cloud be used as 'indications of bad commits' or development practices.

A basic set of examples could be (as blocks of regex)

• (updating|adding)AWSkey
• (deleting|removing)*(secret|key|credential)
• (adding|updating|committing)*(private|ssh|)*key

It would sit quite well in an external file, however, i think you would need to restructure the outputs file a little to ensure parsing the results was a little cleaner.

A structure for this could be as follows:

---
reponame: 
    results: [ ]
    indicators: []

The results array would be the contents as it currently is.
The Indicators could be a set of results in the same format to your current results output (array of hashes) that contain commit message results.

Just my 2 cents :)

K

[zricethezav]

This will be added in the next gitleaks release