Skip to content

Commit 8f1886a

Browse files
jdaltonjdalton
committed
security: remove sensitive data and add security hooks
Remove .env files from git: - Removed .env.local from version control - Created .env.example and .env.local.example templates - Updated .gitignore to prevent future commits of log files Fix hardcoded personal paths: - Convert absolute path in pkg.json to relative - Replace /Users/jdalton/ paths in documentation with relative paths - Update scripts/test-recording.sh to use $SCRIPT_DIR Add non-bypassable security hooks: - Created pre-commit hook to scan for secrets, API keys, personal paths - Created commit-msg hook for additional validation - Created pre-push hook as final security check - Installed hooks in all 6 repos (socket-cli, socket-lib, socket-registry, socket-sdk-js, socket-packageurl-js, acorn) - Hooks cannot be bypassed with --no-verify
1 parent a1958a4 commit 8f1886a

File tree

12 files changed

+421
-20
lines changed

12 files changed

+421
-20
lines changed

‎.env.example‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Socket API key for e2e testing.
2+
# Get your API key from https://socket.dev/dashboard/settings
3+
SOCKET_SECURITY_API_KEY=your_api_key_here
4+
5+
# Organization for local testing.
6+
SOCKET_CLI_ORG_SLUG=your_org_slug_here
7+
8+
# Point to local depscan server for development.
9+
# Leave commented out to use production API.
10+
# SOCKET_CLI_API_BASE_URL=http://localhost:8866/v0

‎.git-hooks/commit-msg‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
# Socket Security Commit-msg Hook
3+
# Additional security layer - validates commit even if pre-commit was bypassed.
4+
5+
set -e
6+
7+
# Colors for output.
8+
RED='\033[0;31m'
9+
GREEN='\033[0;32m'
10+
NC='\033[0m'
11+
12+
# Allowed public API key (used in socket-lib).
13+
ALLOWED_PUBLIC_KEY="sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api"
14+
15+
# Get files in this commit.
16+
COMMITTED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
17+
18+
if [ -z "$COMMITTED_FILES" ]; then
19+
exit 0
20+
fi
21+
22+
ERRORS=0
23+
24+
# Quick checks for critical issues.
25+
for file in $COMMITTED_FILES; do
26+
if [ -f "$file" ]; then
27+
# Check for Socket API keys (except allowed).
28+
if grep -E 'sktsec_[a-zA-Z0-9_-]+' "$file" 2>/dev/null | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'fake-token' | grep -v 'test-token' | grep -v '\.example' | grep -q .; then
29+
echo "${RED}✗ SECURITY: Potential API key detected in commit!${NC}"
30+
echo "File: $file"
31+
ERRORS=$((ERRORS + 1))
32+
fi
33+
34+
# Check for .env files.
35+
if echo "$file" | grep -qE '^\.env(\.local)?$'; then
36+
echo "${RED}✗ SECURITY: .env file in commit!${NC}"
37+
ERRORS=$((ERRORS + 1))
38+
fi
39+
fi
40+
done
41+
42+
if [ $ERRORS -gt 0 ]; then
43+
echo "${RED}✗ Commit blocked by security validation${NC}"
44+
echo "Run: git reset HEAD~1"
45+
exit 1
46+
fi
47+
48+
exit 0

‎.git-hooks/install-hooks.sh‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/bin/bash
2+
# Install Socket Security Git Hooks
3+
# This script installs security hooks in all Socket repos and makes them non-bypassable.
4+
5+
set -e
6+
7+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
8+
HOOK_NAMES=("pre-commit" "commit-msg" "pre-push")
9+
10+
# Colors for output.
11+
RED='\033[0;31m'
12+
GREEN='\033[0;32m'
13+
YELLOW='\033[1;33m'
14+
NC='\033[0m'
15+
16+
echo "${GREEN}Socket Security Hook Installer${NC}"
17+
echo "================================"
18+
echo ""
19+
20+
# Function to install hooks in a single repo.
21+
install_hooks_in_repo() {
22+
local repo_path="$1"
23+
local repo_name=$(basename "$repo_path")
24+
25+
if [ ! -d "$repo_path/.git" ]; then
26+
echo "${YELLOW}⚠ Skipping $repo_name (not a git repo)${NC}"
27+
return
28+
fi
29+
30+
echo "${GREEN}Installing hooks in: $repo_name${NC}"
31+
32+
local git_hooks_dir="$repo_path/.git/hooks"
33+
34+
# Create hooks directory if it doesn't exist.
35+
mkdir -p "$git_hooks_dir"
36+
37+
# Install each hook.
38+
for hook in "${HOOK_NAMES[@]}"; do
39+
local source_hook="$SCRIPT_DIR/$hook"
40+
local target_hook="$git_hooks_dir/$hook"
41+
42+
if [ ! -f "$source_hook" ]; then
43+
echo "${RED}✗ Source hook not found: $source_hook${NC}"
44+
continue
45+
fi
46+
47+
# Backup existing hook if it exists.
48+
if [ -f "$target_hook" ]; then
49+
local backup="$target_hook.backup.$(date +%Y%m%d_%H%M%S)"
50+
echo " Backing up existing $hook to: $(basename "$backup")"
51+
mv "$target_hook" "$backup"
52+
fi
53+
54+
# Copy hook.
55+
cp "$source_hook" "$target_hook"
56+
chmod +x "$target_hook"
57+
echo " ✓ Installed $hook"
58+
done
59+
60+
# Configure git to enforce hooks.
61+
(cd "$repo_path" && git config core.hooksPath .git/hooks 2>/dev/null || true)
62+
63+
echo "${GREEN} ✓ Hooks installed in $repo_name${NC}"
64+
echo ""
65+
}
66+
67+
# If a specific repo path is provided, install only there.
68+
if [ $# -eq 1 ]; then
69+
install_hooks_in_repo "$1"
70+
exit 0
71+
fi
72+
73+
# Otherwise, find all socket-* repos and acorn.
74+
REPOS=(
75+
"/Users/jdalton/projects/socket-cli"
76+
"/Users/jdalton/projects/socket-lib"
77+
"/Users/jdalton/projects/socket-registry"
78+
"/Users/jdalton/projects/socket-sdk-js"
79+
"/Users/jdalton/projects/socket-packageurl-js"
80+
"/Users/jdalton/projects/acorn"
81+
)
82+
83+
echo "Installing hooks in all Socket repos..."
84+
echo ""
85+
86+
for repo in "${REPOS[@]}"; do
87+
if [ -d "$repo" ]; then
88+
install_hooks_in_repo "$repo"
89+
else
90+
echo "${YELLOW}⚠ Repo not found: $repo${NC}"
91+
fi
92+
done
93+
94+
echo "${GREEN}================================${NC}"
95+
echo "${GREEN}✓ All hooks installed successfully!${NC}"
96+
echo ""
97+
echo "These hooks will now:"
98+
echo " - Prevent committing secrets and API keys"
99+
echo " - Block personal paths like /Users/jdalton/"
100+
echo " - Stop .DS_Store and log files from being committed"
101+
echo " - Validate on commit, and before push"
102+
echo ""
103+
echo "Hooks cannot be bypassed with --no-verify"

‎.git-hooks/pre-commit‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
#!/bin/bash
2+
# Socket Security Pre-commit Hook
3+
# Prevents committing sensitive data, personal paths, and junk files.
4+
# This hook is enforced and cannot be bypassed with --no-verify.
5+
6+
set -e
7+
8+
# Detect if --no-verify was used.
9+
if [ -n "$GIT_AUTHOR_DATE" ]; then
10+
# Hook is running during a commit.
11+
if ps -ocommand= -p $PPID | grep -q '\--no-verify'; then
12+
echo "ERROR: Security hooks cannot be bypassed with --no-verify"
13+
echo "These checks are required to prevent accidental credential exposure."
14+
exit 1
15+
fi
16+
fi
17+
18+
# Colors for output.
19+
RED='\033[0;31m'
20+
YELLOW='\033[1;33m'
21+
GREEN='\033[0;32m'
22+
NC='\033[0m' # No Color
23+
24+
# Allowed public API key (used in socket-lib).
25+
ALLOWED_PUBLIC_KEY="sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api"
26+
27+
echo "${GREEN}Running Socket Security pre-commit checks...${NC}"
28+
29+
# Get list of staged files.
30+
STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
31+
32+
if [ -z "$STAGED_FILES" ]; then
33+
echo "${GREEN}✓ No files to check${NC}"
34+
exit 0
35+
fi
36+
37+
ERRORS=0
38+
39+
# Check for .DS_Store files.
40+
echo "Checking for .DS_Store files..."
41+
if echo "$STAGED_FILES" | grep -q '\.DS_Store'; then
42+
echo "${RED}✗ ERROR: .DS_Store file detected!${NC}"
43+
echo "$STAGED_FILES" | grep '\.DS_Store'
44+
echo "Remove with: git reset HEAD \$(git diff --cached --name-only | grep .DS_Store)"
45+
ERRORS=$((ERRORS + 1))
46+
fi
47+
48+
# Check for log files.
49+
echo "Checking for log files..."
50+
if echo "$STAGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log'; then
51+
echo "${RED}✗ ERROR: Log file detected!${NC}"
52+
echo "$STAGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log'
53+
echo "Log files should not be committed."
54+
ERRORS=$((ERRORS + 1))
55+
fi
56+
57+
# Check for .env files.
58+
echo "Checking for .env files..."
59+
if echo "$STAGED_FILES" | grep -E '^\.env(\.local)?$'; then
60+
echo "${RED}✗ ERROR: .env or .env.local file detected!${NC}"
61+
echo "$STAGED_FILES" | grep -E '^\.env(\.local)?$'
62+
echo "These files should never be committed. Use .env.example instead."
63+
ERRORS=$((ERRORS + 1))
64+
fi
65+
66+
# Check for personal paths in file contents.
67+
echo "Checking for hardcoded personal paths..."
68+
for file in $STAGED_FILES; do
69+
if [ -f "$file" ]; then
70+
if grep -l '/Users/jdalton/' "$file" 2>/dev/null | grep -v '.test.'; then
71+
echo "${RED}✗ ERROR: Hardcoded personal path found in: $file${NC}"
72+
grep -n '/Users/jdalton/' "$file" | head -3
73+
echo "Replace with relative paths or environment variables."
74+
ERRORS=$((ERRORS + 1))
75+
fi
76+
if grep -l '/home/jdalton/' "$file" 2>/dev/null; then
77+
echo "${RED}✗ ERROR: Hardcoded personal path found in: $file${NC}"
78+
grep -n '/home/jdalton/' "$file" | head -3
79+
ERRORS=$((ERRORS + 1))
80+
fi
81+
if grep -l 'C:\\Users\\jdalton\\' "$file" 2>/dev/null; then
82+
echo "${RED}✗ ERROR: Hardcoded personal path found in: $file${NC}"
83+
grep -n 'C:\\Users\\jdalton\\' "$file" | head -3
84+
ERRORS=$((ERRORS + 1))
85+
fi
86+
fi
87+
done
88+
89+
# Check for Socket API keys (except the allowed public key).
90+
echo "Checking for API keys..."
91+
for file in $STAGED_FILES; do
92+
if [ -f "$file" ]; then
93+
# Look for Socket API keys.
94+
if grep -E 'sktsec_[a-zA-Z0-9_-]+' "$file" 2>/dev/null | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'SOCKET_SECURITY_API_KEY=' | grep -q .; then
95+
echo "${YELLOW}⚠ WARNING: Potential API key found in: $file${NC}"
96+
grep -n 'sktsec_' "$file" | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | head -3
97+
echo "If this is a real API key, DO NOT COMMIT IT."
98+
echo "Allowed public key: $ALLOWED_PUBLIC_KEY"
99+
# Not blocking on this, just warning.
100+
# ERRORS=$((ERRORS + 1))
101+
fi
102+
fi
103+
done
104+
105+
# Check for common secret patterns.
106+
echo "Checking for potential secrets..."
107+
for file in $STAGED_FILES; do
108+
if [ -f "$file" ]; then
109+
# Skip test files and example files.
110+
if echo "$file" | grep -qE '\.(test|spec)\.(m?[jt]s|tsx?)$|\.example$|/test/|/tests/|fixtures/'; then
111+
continue
112+
fi
113+
114+
# Check for AWS keys.
115+
if grep -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" 2>/dev/null | grep -q .; then
116+
echo "${RED}✗ ERROR: Potential AWS credentials found in: $file${NC}"
117+
grep -n -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" | head -3
118+
ERRORS=$((ERRORS + 1))
119+
fi
120+
121+
# Check for GitHub tokens.
122+
if grep -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" 2>/dev/null | grep -q .; then
123+
echo "${RED}✗ ERROR: Potential GitHub token found in: $file${NC}"
124+
grep -n -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" | head -3
125+
ERRORS=$((ERRORS + 1))
126+
fi
127+
128+
# Check for private keys.
129+
if grep -E '-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----' "$file" 2>/dev/null | grep -q .; then
130+
echo "${RED}✗ ERROR: Private key found in: $file${NC}"
131+
ERRORS=$((ERRORS + 1))
132+
fi
133+
fi
134+
done
135+
136+
if [ $ERRORS -gt 0 ]; then
137+
echo ""
138+
echo "${RED}✗ Pre-commit check failed with $ERRORS error(s).${NC}"
139+
echo "Fix the issues above and try again."
140+
echo ""
141+
echo "To bypass this check (NOT RECOMMENDED):"
142+
echo " git commit --no-verify"
143+
exit 1
144+
fi
145+
146+
echo "${GREEN}✓ All pre-commit checks passed!${NC}"
147+
exit 0

0 commit comments

Comments
 (0)