{"id":13531418,"url":"https://github.com/okta-graveyard/repo-supervisor","last_synced_at":"2025-10-02T10:31:18.214Z","repository":{"id":21278293,"uuid":"82721984","full_name":"auth0/repo-supervisor","owner":"auth0","description":"Scan your code for security misconfiguration, search for passwords and secrets. :mag:","archived":true,"fork":false,"pushed_at":"2023-06-23T07:17:30.000Z","size":1425,"stargazers_count":633,"open_issues_count":18,"forks_count":88,"subscribers_count":33,"default_branch":"master","last_synced_at":"2024-09-24T21:04:31.975Z","etag":null,"topics":["blueteam","redteam","secret-management","secrets","secrets-detection","security","serverless"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/auth0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null}},"created_at":"2017-02-21T20:06:13.000Z","updated_at":"2024-09-11T02:13:24.000Z","dependencies_parsed_at":"2023-10-20T17:58:06.537Z","dependency_job_id":"726b2902-d8ad-43a2-8339-454d5a8a0551","html_url":"https://github.com/auth0/repo-supervisor","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Frepo-supervisor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Frepo-supervisor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Frepo-supervisor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Frepo-supervisor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/auth0","download_url":"https://codeload.github.com/auth0/repo-supervisor/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219875669,"owners_count":16554698,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blueteam","redteam","secret-management","secrets","secrets-detection","security","serverless"],"created_at":"2024-08-01T07:01:02.873Z","updated_at":"2025-10-02T10:31:12.861Z","avatar_url":"https://github.com/auth0.png","language":"JavaScript","funding_links":[],"categories":["\u003ca id=\"862af330f45f21fbb0d495837fc7e879\"\u003e\u003c/a\u003e工具","\u003ca id=\"c49aef477cf3397f97f8b72185c3d100\"\u003e\u003c/a\u003e密码\u0026\u0026凭证","Tools","Miscellaneous","JavaScript","Code review","JavaScript (485)","Application Security","Инструменты"],"sub_categories":["\u003ca id=\"86dc226ae8a71db10e4136f4b82ccd06\"\u003e\u003c/a\u003e密码","Secrets Scanning","Secrets","Reverse shell","Secrets detection","Поиск секретов"],"readme":"# Repo-supervisor\n\n[![Join the chat at https://gitter.im/repo-supervisor/Lobby](https://badges.gitter.im/repo-supervisor/Lobby.svg)](https://gitter.im/repo-supervisor/Lobby)\n[![Build Status](https://travis-ci.org/auth0/repo-supervisor.svg?branch=master)](https://travis-ci.org/auth0/repo-supervisor)\n\n:exclamation: Repo-supervisor is not being actively maintained\n\nThe Repo-supervisor is a tool that helps you to detect secrets and passwords in your code. It's as easy to install as adding a new webhook to your Github repository.\n\nIt works in two separate modes. The first one allows us to scan Github pull requests, and the second one works from the command line where it scans local directories.\n\n- [Repo-supervisor](#repo-supervisor)\n  - [Usage](#usage)\n    - [Pre-requisites](#pre-requisites)\n    - [Command line mode](#command-line-mode)\n    - [Github Pull Request mode](#github-pull-request-mode)\n  - [Supported files](#supported-files)\n  - [Security checks](#security-checks)\n  - [Frequently asked questions](#frequently-asked-questions)\n    - [How does it work?](#how-does-it-work)\n    - [Why doesn't it find any secrets?](#why-doesnt-it-find-any-secrets)\n    - [How to add support for new file types?](#how-to-add-support-for-new-file-types)\n  - [What is Auth0?](#what-is-auth0)\n    - [Create a free account in Auth0](#create-a-free-account-in-auth0)\n  - [Issue Reporting](#issue-reporting)\n  - [Author](#author)\n  - [License](#license)\n\n## Usage\n\n### Pre-requisites\n\nTo start using a tool, download the latest release from the Github releases page. There are two bundles available for both AWS Lambda deployment as well as for the CLI mode. Using CLI mode doesn't require any additional configuration, whereas to use the PR mode, it's necessary to deploy the bundle to AWS Lambda first.\n\n- [AWS Lambda deployment](docs/aws.lambda.deployment.md)\n- [Using a docker image](docs/docker.image.md)\n\n### Command line mode\n\nThe CLI mode allows scanning local directories with source code to detect secrets and passwords in files. That is the simplest deployment option, and it could become a part of the CI pipeline.\n\nFindings might be either returned in the plaintext or JSON format:\n\n```bash\n$ npm ci \u0026\u0026 npm run build\n$ node ./dist/cli.js ./test/fixtures/integration/dir.with.secrets\n\n[./test/fixtures/integration/dir.with.secrets/foo/bar.js]\n\u003e\u003e zJd-55qmsY6LD53CRTqnCr_g-\n\u003e\u003e gm5yb-hJWRoS7ZJTi_YUj_tbU\n\u003e\u003e GxC56B6x67anequGYNPsW_-TL\n\u003e\u003e MLTk-BuGS8s6Tx9iK5zaL8a_W\n\u003e\u003e 2g877BA_TsE-WoPoWrjHah9ta\n\n[./test/fixtures/integration/dir.with.secrets/foo/foo.json]\n\u003e\u003e d7kyociU24P9hJ_sYVkqzo-kE\n\u003e\u003e q28Wt3nAmLt_3NGpqi2qz-jQ7\n\n$ JSON_OUTPUT=1 node ./dist/cli.js ./test/fixtures/integration/dir.with.secrets\n\n{\"result\":[{\"filepath\":\"./test/fixtures/integration/dir.with.secrets/foo/bar.js\",\"secrets\":[\"zJd-55qmsY6LD53CRTqnCr_g-\",\"gm5yb-hJWRoS7ZJTi_YUj_tbU\",\"GxC56B6x67anequGYNPsW_-TL\",\"MLTk-BuGS8s6Tx9iK5zaL8a_W\",\"2g877BA_TsE-WoPoWrjHah9ta\"]},{\"filepath\":\"./test/fixtures/integration/dir.with.secrets/foo/foo.json\",\"secrets\":[\"d7kyociU24P9hJ_sYVkqzo-kE\",\"q28Wt3nAmLt_3NGpqi2qz-jQ7\"]}]}\n```\n\n\n### Github Pull Request mode\n\nRunning a tool in the pull request mode requires to add a new webhook to the Github repository. Webhook should be triggered on a pull request events whenever someone opens, updates, or closes a PR. Therefore, when a scan is triggered, it will update the PR status to either success or failure, depending on findings.\n\nWebhook configuration details:\n\n| Setting      | Value              |\n| ------------ | ------------------ |\n| Payload URL  | AWS Lambda URL     |\n| Content type | `application/json` |\n| Events type  | `Pull requests`    |\n\nWhenever a tool finds security issues, it sets the PR status to error, and it adds a link to view the report. Link to the report is a URL to AWS Lambda deployment with an additional query parameter `?id=\u003cjwt\u003e` that allows to generate the HTML report.\n\nCheck out a sample report:\n\n\u003cdiv style=\"text-align:center\"\u003e\u003cimg src=\"docs/images/pr.report.review.png\"/\u003e\u003c/div\u003e\n\nDepending on the success or failure of the scan, it will set a proper PR status.\n\n**Error - issues detected**\n\n\u003cimg src=\"docs/images/pr.ci.status.error.png\"/\u003e\n\n**Success - no issues were found**\n\n\u003cimg src=\"docs/images/pr.ci.status.success.png\"/\u003e\n\n**A false positive was reported**\n\n\u003cimg src=\"docs/images/pr.ci.status.false.positive.png\"/\u003e\n\n## Supported files\n\nRepo-supervisor aims to decrease the number of false positives as much as possible. It means that it doesn't scan all file types and extensions. Each file is parsed according to its format to extract strings, and this is a context-aware process that requires to use a language tokenizer. The currently supported file types are:\n\n- JSON (.json)\n- JavaScript (.js)\n- YAML (.yaml)\n\nWe plan to add new file types in the future. Read a documentation on [how to add a new file type](docs/add.new.file.type.md) to learn more.\n\n## Security checks\n\nThis is the list of currently implemented checks in a tool:\n\n| Module            | Details                                                                                    |\n| ----------------- | ------------------------------------------------------------------------------------------ |\n| **Entropy Meter** | Finds strings with a high entropy to detect secrets and passwords in supported file types. |\n\n## Frequently asked questions\n\n### How does it work?\n\n**CLI mode:**\n\n- Scan a directory provided as argument\n- Get a list of all files and return only those matching [supported extensions](#supported-files) like `*.json` or `*.js`\n- Process every supported file with a tokenizer (different one for each file type)\n- Iterate over all extracted strings and run security checks on them\n  - Entropy Meter - calculate the entropy value to see if it goes above defined threshold ([maxAllowedEntropy](config/filters/entropy.meter.json))\n- Print out detected issues either in a plain-text or JSON format\n\n**Pull Request mode:**\n\n- Receive a webhook payload\n- Process payload and extract all modified files\n- Iterate over each file:\n  - Use the appropriate tokenizer based on file type\n  - Extract strings from a file\n  - Run security checks on those strings\n- If tool detects issues then it sets CI status to error with a link to the report\n- If no issues were found then it sets CI status to success\n\nRead more on the [CI status](https://developer.github.com/v3/repos/statuses/) definition.\n\n### Why doesn't it find any secrets?\n\nVerify that the secrets you want to find are inside supported file types. Read more in the [Supported files](#supported-files) section.\n\n### How to add support for new file types?\n\nTo support a new file type, you need to create a new parser. Some of the file types might require to use external tokenizers because of the complex structure like [JavaScript](src/parser/tokenizer/js/index.js) files. On the other hand, for simple file types, it's pretty straightforward as it was with [JSON](src/parser/tokenizer/json/index.js) files.\n\nRead more on how to add a [new file type](docs/add.new.file.type.md).\n\n---\n\n## What is Auth0?\n\nAuth0 helps you to:\n\n* Add authentication with [multiple authentication sources](https://docs.auth0.com/identityproviders),\neither social like **Google, Facebook, Microsoft Account, LinkedIn, GitHub, Twitter, Box, Salesforce,\namont others**, or enterprise identity systems like **Windows Azure AD, Google Apps, Active Directory,\nADFS or any SAML Identity Provider**.\n* Add authentication through more traditional\n**[username/password databases](https://docs.auth0.com/mysql-connection-tutorial)**.\n* Add support for **[linking different user accounts](https://docs.auth0.com/link-accounts)** with\nthe same user.\n* Support for generating signed [Json Web Tokens](https://docs.auth0.com/jwt) to call your APIs and\n**flow the user identity** securely.\n* Analytics of how, when and where users are logging in.\n* Pull data from other sources and add it to the user profile, through\n[JavaScript rules](https://docs.auth0.com/rules).\n\n### Create a free account in Auth0\n\n1. Go to [Auth0](https://auth0.com) and click Sign Up.\n2. Use Google, GitHub or Microsoft Account to login.\n\n## Issue Reporting\n\nIf you have found a bug or if you have a feature request, please report them at this repository\nissues section. Please do not report security vulnerabilities on the public GitHub issue tracker.\nThe [Responsible Disclosure Program](https://auth0.com/whitehat) details the procedure for\ndisclosing security issues.\n\n## Author\n\n[Auth0](https://auth0.com)\n\n## License\n\nThis project is licensed under the MIT license. See the [LICENSE](LICENSE) file for more info.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fokta-graveyard%2Frepo-supervisor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fokta-graveyard%2Frepo-supervisor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fokta-graveyard%2Frepo-supervisor/lists"}