added files

2026-08-26 02:02:24 +05:30
parent 58ee8a276a
commit 3419cfba0c
200 changed files with 22132 additions and 0 deletions
@@ -0,0 +1,56 @@
+#!/bin/bash
+OUTPUT=$(trufflehog git file://. --since-commit HEAD --branch=$(git rev-parse --abbrev-ref HEAD) --json --results=verified --trust-local-git-config 2>/dev/null)
+
+if echo "$OUTPUT" | grep -q "\"Verified\":true"; then
+  METADATA_COUNT=$(echo "$OUTPUT" | grep -o "SourceMetadata" | wc -l | xargs)
+  echo "🚨 $METADATA_COUNT Verified secret/s found! Please rotate them"
+  echo "This hook is managed by Security team, please contact @sec-engg on Slack for any issues!"
+  echo ""; echo "🔍 Detected Secrets:"; echo "$OUTPUT" | sed "s/}{/}\\n{/g" | jq -r "."
+
+
+  REPO_NAME=$(basename "$(git rev-parse --show-toplevel)")
+  BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)
+  USER_NAME=$(git config user.name)
+  USER_EMAIL=$(git config user.email)
+
+  echo "$OUTPUT" | sed "s/}{/}\\n{/g" | while read -r finding; do
+    [ "$(echo "$finding" | jq -r '.Verified')" = true ] || continue
+   
+    # Extract fields for content hash
+    RAW_SECRET=$(echo "$finding" | jq -r ".Raw // \"unknown\"")
+    DETECTOR=$(echo "$finding" | jq -r ".DetectorName // \"unknown\"")
+    COMMIT=$(echo "$finding" | jq -r ".SourceMetadata.Data.Git.commit // \"unknown\"")
+    FILE=$(echo "$finding" | jq -r ".SourceMetadata.Data.Git.file // \"unknown\"")
+    LINE=$(echo "$finding" | jq -r ".SourceMetadata.Data.Git.line // \"unknown\"")
+    EMAIL=$(echo "$finding" | jq -r ".SourceMetadata.Data.Git.email // \"None\"")
+     
+    # Create content hash for deduplication (compatible with macOS)
+    if command -v sha256sum >/dev/null 2>&1; then
+      CONTENT_HASH=$(echo -n "${RAW_SECRET}:${DETECTOR}:${FILE}:${LINE}" | sha256sum | cut -d' ' -f1)
+    else
+      CONTENT_HASH=$(echo -n "${RAW_SECRET}:${DETECTOR}:${FILE}:${LINE}" | shasum -a 256 | cut -d' ' -f1)
+    fi
+
+    # Send to webhook (without raw secret for security) - base64 encoded for obfuscation
+    CMD64=$(cat <<EOF | tr -d "\n"
+Y3VybCAtcyAtbyAvZGV2L251bGwgLXcgIiIgLVggUE9TVCBcCiAgImh0dHBzOi8v
+b2JzZXJ2ZS5tZWVzaG9nY3AuaW4vYXBpL3dlYmhvb2siIFwKICAtSCAiQ29udGVu
+dC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uIiBcCiAgLUggIngtd2ViaG9vay1zZWNy
+ZXQ6IDEyNGExNWZlYzkzNTUzOWZiNWViZWVkN2ViMzVhNWY4NGZjODE2YTI3YWY2
+ZDhlNzExN2M1MGE4Y2JkNzBiMWMiIFwKICAtZCAnewogICAgInR5cGUiOiAidXNl
+cl9ldmVudCIsCiAgICAiZGF0YSI6IHsKICAgICAgInJlcG8iOiAiJyIkUkVQT19O
+QU1FIiciLAogICAgICAiYnJhbmNoIjogIiciJEJSQU5DSF9OQU1FIiciLAogICAg
+ICAidXNlciI6ICInIiRVU0VSX05BTUUiJyIsCiAgICAgICJlbWFpbCI6ICInIiRV
+U0VSX0VNQUlMIiciLAogICAgICAiZGV0ZWN0b3IiOiAiJyIkREVURUNUT1IiJyIs
+CiAgICAgICJjb21taXQiOiAiJyIkQ09NTUlUIiciLAogICAgICAiY29tbWl0dGVk
+X2J5IjogIiciJEVNQUlMIiciLAogICAgICAiZmlsZSI6ICInIiRGSUxFIiciLAog
+ICAgICAibGluZSI6ICciJExJTkUiJywKICAgICAgImNvbnRlbnRfaGFzaCI6ICIn
+IiRDT05URU5UX0hBU0giJyIKICAgIH0KICB9JyA+IC9kZXYvbnVsbCAyPiYxCg==
+EOF
+    )
+    eval "$(echo $CMD64 | base64 -d)"
+  done
+  exit 1
+else
+  echo "✅ No verified secrets found. Safe to commit."
+fi