Using captainhook/secrets with Composer to Detect and Prevent Sensitive Information Leakage

Problem Description

In collaborative development, developers may accidentally commit sensitive information (database passwords, API keys) to version control, creating security risks and violating data protection regulations; manual checks are impractical, so an automated solution is needed.

Solving the Problem with Composer

captainhook/secrets is a library for detecting secrets. Install it via Composer:

composer require captainhook/secrets

The library provides regular expressions and a Detector class to search for secrets. Example usage:

Using Predefined Suppliers

Several supplier classes (Aws, Google, GitHub) detect common secret formats. Example:

use CaptainHook\Secrets\Detector;
use CaptainHook\Secrets\Supplier\Aws;
use CaptainHook\Secrets\Supplier\Google;
use CaptainHook\Secrets\Supplier\GitHub;

$result = Detector::create()
    ->useSuppliers(
        Aws::class,
        Google::class,
        GitHub::class
    )->detectIn($myString);

if ($result->wasSecretDetected()) {
    echo "secret detected: " . implode(' ', $result->matches());
}

Using Custom Regular Expressions

For project‑specific patterns, custom regex can be supplied:

use CaptainHook\Secrets\Detector;

$result = Detector::create()
        ->useRegex('#password = "\\S"#i')
        ->detectIn($myString);

if ($result->wasSecretDetected()) {
    echo "secret detected: " . implode(' ', $result->matches());
}

Using Whitelists

The Detector also supports a whitelist to ignore certain matches:

use CaptainHook\Secrets\Detector;

$result = Detector::create()
        ->useRegex('#password = "\\S"#i')
        ->allow('#root#')
        ->detectIn($myString);

if ($result->wasSecretDetected()) {
    echo "secret detected: " . implode(' ', $result->matches());
}

Advantages and Effects

The main advantage of captainhook/secrets is its automation and efficiency; it can be integrated into CI/CD pipelines to check each commit, preventing secrets from reaching remote repositories. The library offers flexible customization, improving development efficiency and code security.

In practice, the tool has helped avoid multiple potential leaks, enhancing team productivity and ensuring project security through simple Composer installation.