vulns.cofield index
Enter
Contribute
Testing playbook · intermediate

Git & CI/CD Secret Recon

Find leaked credentials and internal detail across code, git history, and exposed CI artifacts.

secretsgitcirecon
Stable IDplaybook:cicd-secret-reconLast updatedLast verifiedLegacy review pendingProvenanceCurated workflow
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

01

Find repos & exposed .git

Enumerate the org's public repos and probe web roots for exposed /.git/ directories you can dump.

httpx -l live.txt -path '/.git/HEAD' -mc 200 -silent
httpxnuclei
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
02

Scan history, not just HEAD

Secrets are usually in old commits. Scan full history with verification to cut noise.

trufflehog git https://github.com/org/repo --only-verified
trufflehoggitleaks
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
03

Mine JS & artifacts

Pull JS bundles and CI logs/artifacts for API keys, tokens, and internal endpoints.

cat jsfiles.txt | jsluice secrets
jsluicegetJS
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
04

Validate & scope impact

Confirm a leaked key is live and map what it unlocks (cloud, SaaS, internal APIs) before reporting.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes

Common guidance

  • Dorking org members' personal repos often beats the main org repo.
  • A dumped /.git/ lets you reconstruct source and find more secrets offline.
Related tools

Mapped workflow tools

ToolgetJSToolgitleaksToolhttpxTooljsluiceToolnucleiTooltrufflehog
Sources

References

Version history: normalized permanent page created 2026-08-20.