watson/is-secret

A distributed maintained collection of patterns that indicate that something probably is secret

is-secret

A distributed maintained collection of patterns that indicate that something probably is secret.

This is useful if you want to filter sensitive values in a data set.

This module uses a very simple algorithm that will not catch everthing. Use at your own risk.

Installation

npm install is-secret --save

Usage

var isSecret = require('is-secret')

var data = {
  username: 'watson',
  password: 'f8bY2fg8',
  card: '1234 1234 1234 1234' // credit card number
}

Object.keys(data).forEach(function (key) {
  if (isSecret.key(key) ||
      isSecret.value(data[key])) data[key] = '********'
})

console.log(data)
// {
//   username: 'watson',
//   password: '********',
//   card: '********'
// }

If you need functionality similar to what is shown in this example, I suggest you take a look at the redact-secrets module.

API

secret.key(string)

Validates the given string against a list of key names known to typically indicate secret data.

Returns true if the string is considered secret. Otherwise false.

secret.value(string)

Validates the given string against a list of patterns that indicates secret data.

Returns true if the string is considered secret. Otherwise false.

License

MIT

is-secret's Issues

Add pass to list of KEYS

Hi,

Cool module. I'm using it in conjunction with redact-secrets.

The key 'pass' (/^pass$/) is missing from the KEYS. Can you please add it?

Addition of keys to redact SSH key values

In some platforms, registrations require SSH keys instead of passwords; in such cases, they should also be redacted in the same way passwords are.
I have raised a pull request for the same: #8

Usage mistake

isScecret.key() is used to check data value instead of isSecret.value().

- isSecret.key(data[key])) data[key] = '********'
+ isSecret.value(data[key])) data[key] = '********'

suggestion: pull in regexes from git-secrets/git-secrets

the git-secrets tool is evidently pretty popular. their regexes include the following:

  local aws="(AWS|aws|Aws)?_?" quote="(\"|')" connect="\s*(:|=>|=)\s*"
  local opt_quote="${quote}?"
  add_config 'secrets.patterns' '(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}'
  add_config 'secrets.patterns' "${opt_quote}${aws}(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)${opt_quote}${connect}${opt_quote}[A-Za-z0-9/\+=]{40}${opt_quote}"
  add_config 'secrets.patterns' "${opt_quote}${aws}(ACCOUNT|account|Account)_?(ID|id|Id)?${opt_quote}${connect}${opt_quote}[0-9]{4}\-?[0-9]{4}\-?[0-9]{4}${opt_quote}"

would you consider adding these? I can provide a PR.