How to Secure Your GitHub Project: Identifying and Eliminating Hardcoded Secrets with Snyk

Original Post: Finding and fixing exposed hardcoded secrets in your GitHub project with Snyk

This blog post discusses using Snyk and Doppler to manage and fix hardcoded secrets in projects. It specifically demonstrates the process using the open-source Snyk goof project, a Node.js application filled with vulnerabilities. Here’s a summarized workflow:

1. Setup:

   • Fork the Snyk goof project.
   • Create a Snyk account and link it to your GitHub account.
   • Enable Snyk to scan your projects and generate Fix Pull Requests.

2. Initial Analysis:

   • Add the goof project to your Snyk account.
   • Snyk will create a dependency graph and compare it to its vulnerability database to generate a report.

3. Identifying Hardcoded Secrets:

   • Use Snyk’s code analysis to find hardcoded credentials and secrets.

4. Refactoring Secrets to Doppler:

   • Clone the goof project.
   • Replace hardcoded secrets with environment variables managed by Doppler.
   • Create a Doppler account and a new project for goof.
   • Add secrets to Doppler and replace hardcoded values in the code with environment variables utilizing Doppler CLI for secure management.

5. Final Integration:

   • Configure Doppler CLI in the project directory.
   • Use doppler run to inject secrets into the application’s environment during runtime.
6. Conclusion:
   • Integrating Snyk and Doppler improves security and efficiency in development workflows.
   • Scheduling demos for Snyk and Doppler can further enhance understanding and utilization.

The blog emphasizes the seamless integration of Snyk and Doppler to manage and secure development projects effectively.

Go here to read the Original Post