The module for detecting secrets is great, if they conform to the regex. However whilst researching the a postman module for #898 I have found quite a few secrets that are generic "X-API-Token", "token" or "password" for internal services that would not match against any of them regex's.
I have put these into ChatGPT and it has managed to identify it is a secret using this simple prompt
"Can you take a look at this source code and see if you can identify any plaintext secrets"
I can see another module has been suggested with an OpenAI API key. It might be an idea to use this API key with the secrets detection module.
For example if none of the regex's match in the secrets detection module then make a request to the AI with something similar to the above prompt.
OFC this would need more investigation to see how many false positives this produces, but it could be useful
The module for detecting secrets is great, if they conform to the regex. However whilst researching the a postman module for #898 I have found quite a few secrets that are generic "X-API-Token", "token" or "password" for internal services that would not match against any of them regex's.
I have put these into ChatGPT and it has managed to identify it is a secret using this simple prompt
"Can you take a look at this source code and see if you can identify any plaintext secrets"
I can see another module has been suggested with an OpenAI API key. It might be an idea to use this API key with the secrets detection module.
For example if none of the regex's match in the secrets detection module then make a request to the AI with something similar to the above prompt.
OFC this would need more investigation to see how many false positives this produces, but it could be useful