A token and a database password in one commit

Both files are staged, the hook runs nosecrets scan --staged. The commit stops (exit status 1); the report names file, line, rule and a masked preview, never the secret itself.

A token and a database password in one commit

site/captures/usecases/leaked-key/

# .env
APP_ENV=production
DATABASE_URL=postgres://admin:Tr0ub4dor-and-3@db.internal:5432/app

# deploy.py
import requests

GITHUB_TOKEN = "ghp_R2kT9xLm4Qv7Bn3Zc8Wd5Hf1Jg6Ys0AaPeXq"

def release(version):
    return requests.post(
        "https://api.github.com/repos/acme/app/releases",
        headers={"Authorization": f"token {GITHUB_TOKEN}"},
        json={"tag_name": version},
    )

$ git add deploy.py .env
$ nosecrets scan --staged
.env:2:31 [HIGH] Postgres Connection URI (postgres-connection-uri) nsi_31013ade6422
  preview: Tr0...
deploy.py:3:17 [CRITICAL] GitHub Personal Access Token (github-pat) nsi_5e31772c2cb9
  preview: ghp_...PeXq
$ echo $?
1

scan --staged
github-pat
postgres-connection-uri
exit 1