# Install trufflehog -weight: 500;">pip -weight: 500;">install trufflehog # Scan your repo trufflehog -weight: 500;">git file://./your-repo --only-verified # Install trufflehog -weight: 500;">pip -weight: 500;">install trufflehog # Scan your repo trufflehog -weight: 500;">git file://./your-repo --only-verified # Install trufflehog -weight: 500;">pip -weight: 500;">install trufflehog # Scan your repo trufflehog -weight: 500;">git file://./your-repo --only-verified # Install -weight: 500;">brew -weight: 500;">install gitleaks # Mac # or -weight: 500;">docker run -v $(pwd):/path zricethezav/gitleaks:latest detect --source /path # Run gitleaks detect --source . # Install -weight: 500;">brew -weight: 500;">install gitleaks # Mac # or -weight: 500;">docker run -v $(pwd):/path zricethezav/gitleaks:latest detect --source /path # Run gitleaks detect --source . # Install -weight: 500;">brew -weight: 500;">install gitleaks # Mac # or -weight: 500;">docker run -v $(pwd):/path zricethezav/gitleaks:latest detect --source /path # Run gitleaks detect --source . # .gitignore essentials .env .env.local *.pem *_rsa config/secrets.yml # .gitignore essentials .env .env.local *.pem *_rsa config/secrets.yml # .gitignore essentials .env .env.local *.pem *_rsa config/secrets.yml # Node.js -weight: 500;">npm audit -weight: 500;">npm audit fix # Python -weight: 500;">pip -weight: 500;">install safety safety check # Ruby bundle audit check ---weight: 500;">update # Node.js -weight: 500;">npm audit -weight: 500;">npm audit fix # Python -weight: 500;">pip -weight: 500;">install safety safety check # Ruby bundle audit check ---weight: 500;">update # Node.js -weight: 500;">npm audit -weight: 500;">npm audit fix # Python -weight: 500;">pip -weight: 500;">install safety safety check # Ruby bundle audit check ---weight: 500;">update found 3 vulnerabilities (1 moderate, 2 high) Run `-weight: 500;">npm audit fix` to fix 1 of 3 vulnerabilities. 2 vulnerabilities require manual review. See the full report for details. found 3 vulnerabilities (1 moderate, 2 high) Run `-weight: 500;">npm audit fix` to fix 1 of 3 vulnerabilities. 2 vulnerabilities require manual review. See the full report for details. found 3 vulnerabilities (1 moderate, 2 high) Run `-weight: 500;">npm audit fix` to fix 1 of 3 vulnerabilities. 2 vulnerabilities require manual review. See the full report for details. cat .github/workflows/*.yml | grep -E "-weight: 500;">curl|-weight: 500;">wget|bash <" cat .github/workflows/*.yml | grep -E "-weight: 500;">curl|-weight: 500;">wget|bash <" cat .github/workflows/*.yml | grep -E "-weight: 500;">curl|-weight: 500;">wget|bash <" # Bad - run: -weight: 500;">curl https://some-site.com/-weight: 500;">install.sh | bash # Good - run: | -weight: 500;">curl -fsSL https://some-site.com/-weight: 500;">install.sh -o -weight: 500;">install.sh sha256sum -weight: 500;">install.sh # verify checksum bash -weight: 500;">install.sh # Bad - run: -weight: 500;">curl https://some-site.com/-weight: 500;">install.sh | bash # Good - run: | -weight: 500;">curl -fsSL https://some-site.com/-weight: 500;">install.sh -o -weight: 500;">install.sh sha256sum -weight: 500;">install.sh # verify checksum bash -weight: 500;">install.sh # Bad - run: -weight: 500;">curl https://some-site.com/-weight: 500;">install.sh | bash # Good - run: | -weight: 500;">curl -fsSL https://some-site.com/-weight: 500;">install.sh -o -weight: 500;">install.sh sha256sum -weight: 500;">install.sh # verify checksum bash -weight: 500;">install.sh # Install trivy -weight: 500;">brew -weight: 500;">install trivy # Mac # or -weight: 500;">docker run aquasec/trivy image your-image:latest # Scan your image trivy image your-image:latest # Install trivy -weight: 500;">brew -weight: 500;">install trivy # Mac # or -weight: 500;">docker run aquasec/trivy image your-image:latest # Scan your image trivy image your-image:latest # Install trivy -weight: 500;">brew -weight: 500;">install trivy # Mac # or -weight: 500;">docker run aquasec/trivy image your-image:latest # Scan your image trivy image your-image:latest # Bad: running as root FROM node:18 COPY . . CMD ["node", "server.js"] # Good: create a non-root user FROM node:18 RUN addgroup --system appgroup && adduser --system appuser --ingroup appgroup USER appuser COPY --chown=appuser:appgroup . . CMD ["node", "server.js"] # Bad: running as root FROM node:18 COPY . . CMD ["node", "server.js"] # Good: create a non-root user FROM node:18 RUN addgroup --system appgroup && adduser --system appuser --ingroup appgroup USER appuser COPY --chown=appuser:appgroup . . CMD ["node", "server.js"] # Bad: running as root FROM node:18 COPY . . CMD ["node", "server.js"] # Good: create a non-root user FROM node:18 RUN addgroup --system appgroup && adduser --system appuser --ingroup appgroup USER appuser COPY --chown=appuser:appgroup . . CMD ["node", "server.js"] # Check if any secrets are exposed as env vars in your k8s pods -weight: 500;">kubectl get pods -o yaml | grep -A 5 env | grep -v "^--" # Or check -weight: 500;">docker inspect -weight: 500;">docker inspect <container> | grep -A 20 Env # Check if any secrets are exposed as env vars in your k8s pods -weight: 500;">kubectl get pods -o yaml | grep -A 5 env | grep -v "^--" # Or check -weight: 500;">docker inspect -weight: 500;">docker inspect <container> | grep -A 20 Env # Check if any secrets are exposed as env vars in your k8s pods -weight: 500;">kubectl get pods -o yaml | grep -A 5 env | grep -v "^--" # Or check -weight: 500;">docker inspect -weight: 500;">docker inspect <container> | grep -A 20 Env - API keys committed in .env files - AWS/GCP credentials in config files - Database passwords in hardcoded strings - Downloading scripts from the internet and running them directly - GITHUB_TOKEN with write permissions you don't need - Secrets printed to logs with echo $SECRET