Hacker News: zricethezav

New comment by zricethezav in "Ask HN: What Are You Working On? (May 2026)"

zricethezav — Sun, 10 May 2026 19:02:26 +0000

I've been working on Betterleaks for the past three months. It's the successor to Gitleaks since I'm not focused on that project much anymore. I just released v1.2.0 which added GitHub as a source to scan for secrets against and a new filtering system powered by CEL for more expressiveness.

https://betterleaks.com

New comment by zricethezav in "I wrote Gitleaks, now I'm maintaining Betterleaks"

zricethezav — Thu, 12 Mar 2026 16:34:41 +0000

8 years ago I wrote the first lines of Gitleaks and have been hooked on finding leaked secrets since. Gitleaks grew from a small project to a name recognized by developers and security folks. It sucks but I gotta take a step back from the project. I'll cut security releases but don't expect any new features from me. But I'm not stepping back from secrets scanning! I'm working full time on maintaining Betterleaks, a drop-in replacement for Gitleaks with some fun new features and improvements like rule-defined validation, faster scans, new filters like token efficiency, and more.

Happy to chat about it and sorry if this causes any migration headache

`alias gitleaks='betterleaks'` should do the trick

I wrote Gitleaks, now I'm maintaining Betterleaks

zricethezav — Thu, 12 Mar 2026 16:34:41 +0000

Article URL: https://www.aikido.dev/blog/betterleaks-gitleaks-successor

Comments URL: https://news.ycombinator.com/item?id=47353454

Points: 15

# Comments: 3

New comment by zricethezav in "Show HN: I built a tool that helps people scan and clean any repo for secrets"

zricethezav — Tue, 22 Oct 2024 20:27:17 +0000

looks familiar

New comment by zricethezav in "I analyzed Stack Overflow for secrets"

zricethezav — Fri, 17 Nov 2023 21:04:13 +0000

> gitleaks : fatal error: runtime: out of memory

Should be fixed now: https://github.com/gitleaks/gitleaks/pull/1292. Thanks for highlighting this simple change I've been putting off :)

Live API Keys and Source Code Leaked in 4,500 of the Top Alexa Sites

zricethezav — Tue, 05 Sep 2023 16:31:53 +0000

Article URL: https://trufflesecurity.com/blog/4500-of-the-top-1-million-websites-leaked-source-code-secrets/

Comments URL: https://news.ycombinator.com/item?id=37394160

Points: 13

# Comments: 0

Show HN: Forager – Browse millions of live secrets leaked from GitHub/NPM

zricethezav — Fri, 21 Jul 2023 17:04:38 +0000

Article URL: https://trufflesecurity.com/blog/introducing-forager/

Comments URL: https://news.ycombinator.com/item?id=36816425

Points: 2

# Comments: 0

New comment by zricethezav in "Browse millions of secrets leaked in GitHub/NPM via Forager"

zricethezav — Wed, 19 Jul 2023 18:45:13 +0000

Agreed! 1/1000 is pretty frequent considering how many pushes to GitHub happen every single day. Folks probably get a false sense of security thinking no one is looking at their personal repos (spoiler alert... they are!)

Browse millions of secrets leaked in GitHub/NPM via Forager

zricethezav — Wed, 19 Jul 2023 17:31:07 +0000

Article URL: https://trufflesecurity.com/blog/introducing-forager/

Comments URL: https://news.ycombinator.com/item?id=36790112

Points: 11

# Comments: 3

New comment by zricethezav in "Toyota suffered a data breach by accidentally exposing a secret key on GitHub"

zricethezav — Thu, 13 Oct 2022 21:51:28 +0000

Gitleaks also offers a nice pre-commit hook: https://github.com/zricethezav/gitleaks#pre-commit

New comment by zricethezav in "Toyota suffered a data breach by accidentally exposing a secret key on GitHub"

zricethezav — Thu, 13 Oct 2022 21:28:09 +0000

Good reminder to run Gitleaks or Gitleaks-Action on your repos

- https://github.com/zricethezav/gitleaks

- https://gitleaks.io/products

New comment by zricethezav in "Toyota suffered a data breach by accidentally exposing a secret key on GitHub"

zricethezav — Thu, 13 Oct 2022 21:24:16 +0000

If using GitHub-Actions, Gitleaks offers competitive pricing for a secret scanning solution.

https://gitleaks.io/products

New comment by zricethezav in "Entitlement in Open Source"

zricethezav — Wed, 21 Sep 2022 17:49:16 +0000

I'm doing something similar with gitleaks: https://gitleaks.io/support.html

So far it's working out great.

New comment by zricethezav in "Entitlement in Open Source"

zricethezav — Wed, 21 Sep 2022 17:47:41 +0000

I recently tried my hand in commercializing my open source project, gitleaks (http://gitleaks.io). I'm keeping the core gitleaks project MIT but changed the gitleaks-action on GitHub to a commercial license. Revenue from the commercial license and maintenance agreements has netted me much more than donations I've received over the past couple years. I encourage any open source maintainer to try and find a business model (plugin, dual license, enterprise support, etc) for their project.

FWIW, here is a blog post explaining the rationale behind starting an LLC https://blog.gitleaks.io/gitleaks-llc-announcement-d7d06a52e...

New comment by zricethezav in "Hardcoded password in Confluence app has been leaked on Twitter"

zricethezav — Fri, 22 Jul 2022 20:59:23 +0000

Good reminder to run https://gitleaks.io on your projects

New comment by zricethezav in "Billion-record stolen Chinese database for sale on breach forum"

zricethezav — Tue, 05 Jul 2022 23:23:39 +0000

hardcoded creds in example documentation... T_T

Use vault, env vars, GitHub/GitLab secrets, anything but string literals!!!

New comment by zricethezav in "Billion-record stolen Chinese database for sale on breach forum"

zricethezav — Tue, 05 Jul 2022 23:21:10 +0000

`pass` by itself might introduce false positives. `passwd` and `password` are common and more likely to be in the ROI of a secret. That said, I'm not opposed to `pass` by itself. I'll have to think about this one...

> but I assume they were chosen based on the statistics?

Nope, not statistics. Identifiers and keywords are chosen based on what I see out in the wild being a software engineer.

New comment by zricethezav in "Billion-record stolen Chinese database for sale on breach forum"

zricethezav — Tue, 05 Jul 2022 20:55:06 +0000

More and more providers have been adding unique prefixes to their tokens and access keys which makes detection much easier. Ex, GitLab adds `glpat-` to their PAT.

A project I maintain, Gitleaks, can easily detect "unique" secrets and does a pretty good job at detecting "generic" secrets too. In this case, the generic gitleaks rule would have caught the secrets [1]. You can see the full rule definition here [2] and how the rule is constructed here [3].

[1] https://regex101.com/r/CLg9TK/1

[2] https://github.com/zricethezav/gitleaks/blob/master/config/g...

[3] https://github.com/zricethezav/gitleaks/blob/master/cmd/gene...

New comment by zricethezav in "Billion-record stolen Chinese database for sale on breach forum"

zricethezav — Tue, 05 Jul 2022 20:30:30 +0000

Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the gitleaks' generic rule [2]

[1] https://regex101.com/r/CLg9TK/1

[2] https://github.com/zricethezav/gitleaks/blob/master/config/g...

New comment by zricethezav in "Ask HN: What are some good non-subscription Mac apps?"

zricethezav — Tue, 10 May 2022 15:33:54 +0000

monodraw - https://monodraw.helftone.com/ like paint but for ascii art

I used it to come up with the new gitleaks logo: https://github.com/zricethezav/gitleaks