Secretlint prevent committing your {npm,AWS,GCP,slack,ssh} credential
Tags: secretlint, node, javascript, typescript
Published: 2020-04-03 13:49:43

---
title: "Secretlint prevent committing your {npm,AWS,GCP,slack,ssh} credential"
published: true
description: "Secretlintis that Pluggable linting tool to prevent committing credential."
tags: 
- secretlint
- node.js
- JavaScript
- TypeScript
---

[Secretlint](https://github.com/secretlint/secretlint) 1.0.0 is Released🎉

Secretlint is pluggable linting tool to prevent committing credential like SSH private key, GCP Access token, AWS Access Token, Slack Token, and npm auth token.

Its demo that prevent committing slack access token.

{% twitter 1245970623681060864 %} 

## What is Secretlint?

[Secretlint](https://github.com/secretlint/secretlint) is that Pluggable linting tool to prevent committing credential.
Secretlint is similar with [ESLint](https://eslint.org/) or [textlint](https://textlint.github.io/).

💡 Secretlint has primitive feature that scan your files and report credentials in your files.

You can use Secretlint in one-line command.

If you already have installed Docker:

    docker run -v `pwd`:`pwd` -w `pwd` --rm -it secretlint/secretlint secretlint "**/*"

If you already have installed Node.js:

    npx @secretlint/quick-start "**/*"

Secretlint report error If your files inclues credentials like SSH private key, GCP Access token, AWS Access Token, Slack Token, and npm auth token. 
Because it is secret data!

For more details, Please see Installtion guide

- https://github.com/secretlint/secretlint#installation

We have provided Secretlint as Docker Image and Node.js CLI.
In near future, We also a single binary edition for Secretlint.

If your files includes credentials, Secretlint report it.

![Secretlint error report](https://dev-to-uploads.s3.amazonaws.com/i/flbwtvx2jdi30bxihkcr.png)

## Why Secretlint?

In the world, Already exists credential scanner tools like [awslabs/git-secrets](https://github.com/awslabs/git-secrets), [truffleHog](https://github.com/dxa4481/truffleHog), [detect-secrets](https://github.com/Yelp/detect-secrets), and more.

Secretlint has a Philosophy. 

- Reduce false-positive of linting
- Integration to developing workflow
- Empower Users to Contribute

### Reduce false-positive of linting

In our experience, false-positive is biggest issue of litting tools.
(Secretlint creator is same with [textlint](https://github.com/textlint/textlint))
So, We are working that reduce false-positive in secretlint rules.

Secretlint adopt Opt-in instead of Opt-out.
It means that You can select a rule and introduce the rule by own.
However, Select everything is hard and We also provide [recommened rule set](https://github.com/secretlint/secretlint/tree/master/packages/@secretlint/secretlint-rule-preset-recommend).

Currently, Secretlint has implemented following rules.

- [@secretlint/secretlint-rule-npm](https://www.npmjs.com/package/@secretlint/secretlint-rule-npm)
- [@secretlint/secretlint-rule-aws](https://www.npmjs.com/package/@secretlint/secretlint-rule-aws)
- [@secretlint/secretlint-rule-gcp](https://www.npmjs.com/package/@secretlint/secretlint-rule-gcp)
- [@secretlint/secretlint-rule-privatekey](https://www.npmjs.com/package/@secretlint/secretlint-rule-privatekey)
- [@secretlint/secretlint-rule-basicauth](https://www.npmjs.com/package/@secretlint/secretlint-rule-basicauth)
- [@secretlint/secretlint-rule-slack](https://www.npmjs.com/package/@secretlint/secretlint-rule-slack)
- [@secretlint/secretlint-rule-secp256k1-privatekey](https://www.npmjs.com/package/@secretlint/secretlint-rule-secp256k1-privatekey)
- [@secretlint/secretlint-rule-no-k8s-kind-secret](https://www.npmjs.com/package/@secretlint/secretlint-rule-no-k8s-kind-secret)

### Integration to developing workflow

Secretlint is Project Friendly tool.
It is easy to integrate your CI service like  Circle CI, and GitHub ACtions.
If the Pull Request includes credentilas, CI is failed.

For more details, see following document.

- https://github.com/secretlint/secretlint#ci

Also, you can integrate Secretlint with Git pre-commit hook.
This integration prevent you to commit credential into your project.

[GitHub can not remove sensitive data](https://help.github.com/en/github/authenticating-to-github/removing-sensitive-data-from-a-repository) from a repository without contacting GitHub Support.
So, pre-commit hook is best way to prevent committing credentials

For more details, see following document.

- https://github.com/secretlint/secretlint#pre-commit-hook-per-project

### Empower Users to Contribute

Secretlint adopt pluggable archtecture.
So, you can write own secretlint rule and use it.

Next development guide describe how to create secretelint rule.

- https://github.com/secretlint/secretlint/blob/master/docs/secretlint-rule.md

This concept also effect secretlint core implementation.
[@secretlint/core](https://github.com/secretlint/secretlint/tree/master/packages/%40secretlint/core) has not built-in rules.
Instead of it, We created [@secretlint/secretlint-rule-preset-recommend](https://github.com/secretlint/secretlint/tree/master/packages/%40secretlint/secretlint-rule-preset-recommend) as separated packages.

## Next Secretlint

Secretlint is first stage yet.
We will improve secretlint for getting continuous security.

If you want to contribute, please see [label:good first issue](https://github.com/secretlint/secretlint/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) and [help wanted](https://github.com/secretlint/secretlint/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22).