Regarding "Hardcoded password".

[mightysai1997]

whether Gitleaks will detect "Hardcoded password" or not.

I added

var password = “123password123”

to my nodejs file. The NodeJS file change triggered a NodeJS error (not secrets).

why it is not detecting ?

[rgmz]

It's possible that secret is being detected but ignored because "password123" is a common test/sample password.

Try changing it to a more realistic password and see if that gets detected.

[sharovik]

I would say, the most common cases are the usage of weak passwords. I believe we need to add the rule for that.

What if we will use something like this in the gitleaks config?

[[rules]]

# Unique identifier for this rule
id = "password"

# Short human readable description of the rule.
description = "password"

# Golang regular expression used to detect secrets. Note Golang's regex engine
# does not support lookaheads.
regex = '''(?im)(password)+.+(['"].*['"])'''

# Array of strings used for metadata and reporting purposes.
tags = ["password",]

# Int used to extract secret from regex match and used as the group that will have
# its entropy checked if `entropy` is set.
secretGroup = 2

# Float representing the minimum shannon entropy a regex group must have to be considered a secret.
entropy = 3.5

# Keywords are used for pre-regex check filtering. Rules that contain
# keywords will perform a quick string compare check to make sure the
# keyword(s) are in the content being scanned. Ideally these values should
# either be part of the idenitifer or unique strings specific to the rule's regex
# (introduced in v8.6.0)
keywords = [
  "auth",
  "password",
  "token",
]

Just create the gitleaks.toml file and add this rule into this file. Then, run the gitleaks command with this config
gitleaks detect -v -c gitleaks.toml

[mightysai1997]

I have added the
var password = "S@LtPepp3r@";
in the index.js file and I committed it.

Even though Git leaks was not detecting that hard coded password as vulnerability.

let me known if any thing that needs to add.

[mightysai1997]

Hi Richard Gomez,
Is there any update on the above mention comment.

I want to know whether the gitleaks was pulling latest commit or not.

[mightysai1997]

base) chandra@chandra-Aspire-A715-42G:~/pygoat$ gitleaks detect -v -c gitleaks.toml
INFO[0000] opening .
INFO[0000] scan time: 19 milliseconds 663 microseconds
INFO[0000] No leaks found

[sharovik]

As I can see, you have in your string the different quotes, which are not valid, at least in javascript.

So, please make sure:

1. update your code to use the right quotes
   var password = "123password123" instead var password = “123password123”
2. update regexp to have your quotes (password)+.+(['"“].*['"”]), if you want to keep them

[mightysai1997]

Issue get resolved