Package: secureli
seCureLIThe Builder's Security CLIseCureLI is a tool that enables you to experience the delight of building products by helping you get ideas from your head into working software as frictionlessly as possible, in a reliable, secure, scalable, and observable way.seCureLI:scans your local repo for secrets before you commit code to a remote repositoryinstalls linters based on the code of your project to support security and coding best practicesconfigures all the hooks needed so you don’t have toseCureLI isn’t a magic tool that makes things secure because you have it. It enables a lot of other tools that you could set up individually and helps you as a builder write better code.Looking to contribute? Read ourCONTRIBUTING.mdInstallationHomebrewTo install seCureLI via homebrew, issue the following commandsbrew tap slalombuild/secureli
brew install securelipip (Package Installer for Python)To install seCureLI via pip, issue the following commandspip install secureliUsageHelpOnce installed you can see the latest documentation for seCureLI by entering the following on a command prompt:$secureli--helpYou will see a list of commands and descriptions of each. You can also pull up documentation for each command with the same pattern. For example:$secureliinit--helpUsage:secureliinit[OPTIONS]Detectlanguagesandinitializepre-commithooksandlintersfortheproject

╭─Options──────────────────────────────────────────────────────────────────────────────────────╮
│--reset-rDisregardtheinstalledconfiguration,ifany,andtreatasanewinstall│
│--yes-ySay'yes'toeverypromptautomaticallywithoutinput│
│--directory.,-dPATHRunsecureliagainstaspecificdirectory[default:.]│--helpShowthismessageandexit.│
╰────────────────────────────────────────────────────────────────────────────────────────────────╯When invoking these commands, you can combine the short versions into a single flag. For example, the following commands are equivalent:%secureliinit--reset--yes
%secureliinit-ryInitAfter seCureLI is installed, you can use it to configure your local git repository with a set of pre-commit hooks appropriate for your repo, based on the languages found in your repo's source code files.All you need to do is run:%secureliinitRunningsecureli initwill allow seCureLI to detect the languages in your repo, install pre-commit, install all the appropriate pre-commit hooks for your local repo, run a scan for secrets in your local repo, and update the installed hooks.UpgradeUpgrading seCureLI via HomebrewIf you installed seCureLI using Homebrew, you can use the standard homebrew update command to pull down the latest formula.brew updateUpgrading via pipIf you installed seCureLI using pip, you can use the following command to upgrade to the latest version of seCureLI.pip install --upgrade secureliUpgrading pre-commit hooks for repoIn order to upgrade to the latest released version of each pre-commit hook configured for your repo, use the following command.secureli update --latestConfigurationseCureLI is configurable via a .secureli.yaml file present in the root of your local repository..secureli.yamltop levelKeyDescriptionrepo_filesAffects how seCureLI will interpret the repository, both for language analysis and as it executes various linters.echoAdjusts how seCureLI will print information to the user.language_supportAffects seCureLI's language analysis and support phase.telemetryIncludes options for seCureLI telemetry/api loggingrepo_filesKeyDescriptionmax_file_sizeA number in bytes. Files over this size will not be considered during language analysis, for speed purposes. Default: 100000ignored_file_extensionsWhich file extensions not to consider during language analysis.exclude_file_patternsWhich file patterns to ignore during language analysis and code analysis execution. Use a typical file pattern you might find in a .gitignore file, such as*.pyortests/. Certain patterns you will have to wrap in double-quotes for the entry to be valid YAML.echoKeyDescriptionlevelThe log level to display to the user. Defaults to ERROR, which includeserrorandprintmessages, without including warnings or info messages.telemetryKeyDescriptionapi_urlThe url endpoint to post telemetry logs to. This value is an alternative to setting the url as an environment variable. Note: The environment variable will precede this setting valueUsing Observability Platform to Show Secret Detection StatisticsseCureLI can send secret detection events to an observability platform, such as New Relic. Other platforms may also work, but have not been tested.
Should you need seCureLI to work with other platforms, please create a new issue in github, or contribute to the open source project.Steps for New RelicAssuming, seCureLI has been setup and installed, sign up to New Relic Log Platformhttps://docs.newrelic.com/docs/logs/log-api/introduction-log-api/Retrieve API_KEY and API_ENDPOINT from New Relic. API_ENDPOINT for New Relic should behttps://log-api.newrelic.com/log/v1On your development machine, setup environment variable with variable name SECURELI_LOGGING_API_KEY and SECURELI_LOGGING_API_ENDPOINT. The endpoint can alternatively be added and commited to source control via the .secureli.yaml file.Once the above setup is complete, everytime seCureLI triggered, it should send a usage log to New RelicIn New Relic, you can create a dashboard of metric to see the number of times secret was caught using query such asFROM Log Select sum(failure_count_details.detect_secrets) as 'Caught Secret Count'LicenseCopyright 2024 Slalom, Inc.Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License atApache 2.0 LicenseUnless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.