Add secretlint for secret linting #1177

Activity

1. github-actions commented on Feb 23, 2025

   

   github-actionsBot

   on Feb 23, 2025 – with GitHub Actions

   Last edited by pelikhan

   Contributor

   More actions

   I would like to propose adding secretlint for on-the-fly secret detection.

   SecretLint is a tool that helps detect and manage secrets in code, configuration files, and other parts of your project. It can be easily integrated into your development environment, continuously checking your code as you work.

   By incorporating SecretLint, we can ensure that sensitive information like API keys, passwords, and other secrets are not accidentally exposed or committed to our version control system. This will help us maintain the security and integrity of our project throughout its lifecycle.

   AI-generated content by issue-reviewer may be incorrect
2. pelikhan commented on Feb 26, 2025

   

   Peli de Halleux (pelikhan)

   on Feb 26, 2025

   MemberAuthor

   More actions

   secretlint should be called through the CLI as it is compiled as a .cjs and it does not provide a esm library.
3. pelikhan commented on Feb 26, 2025

   

   Peli de Halleux (pelikhan)

   on Feb 26, 2025

   MemberAuthor

   More actions

   this is not about running secretlint on this repo. We want to run secretlint on any request going to a LLM provider on the fly.

   Probably by piping the request to secretlint via stdin
4. pelikhan commented on Feb 26, 2025

   

   Peli de Halleux (pelikhan)

   on Feb 26, 2025

   MemberAuthor

   More actions

   in genaiscript, we use execa to run processes use this. do not start a server
5. github-actions commented on Feb 26, 2025

   

   github-actionsBot

   on Feb 26, 2025 – with GitHub Actions

   Contributor

   More actions

   Understood! I will not suggest starting a pull request based on the information provided. Instead, I will offer comments that help clarify the requirements and provide guidance as needed.

   Clarification Needed

   It seems there might be a misunderstanding regarding how secret linting should be implemented. The conversation indicates a requirement to run secretlint "on-the-fly" for requests going to LLM providers, which initially seemed like an edge case but now appears to be more concrete.

   Recommendations

   To address this requirement effectively, consider the following:

   1. SecretLint Configuration:

      • Ensure proper configuration of secretlint according to your project's needs. The .secretlintrc.json file should include rules specific to detecting secrets in different types of files (e.g., JSON, YAML, configuration files).

   2. Integrating with LLM Providers:

      • Determine if it makes sense to set up a middleware or pre-hook that intercepts requests before they reach the LLM provider. This could involve piping the request data through secretlint.
      • If piping is used, verify that the data format (e.g., JSON) can be processed by secretlint properly.

   3. Development and Testing:

      • Set up a local development environment to test secret linting on requests.
      • Run tests to ensure that sensitive information is correctly detected and reported.

   4. Documentation:

      • Document the secret linting setup and provide guidelines for maintaining it, including any necessary adjustments when updating the tool or integration points.

   Example Implementation

   A possible implementation could involve a middleware script that wraps the request handling logic and pipes the data through secretlint before it reaches the LLM provider. Below is an example using Node.js:

   const { execa } = require('execa');
   
   async function handleRequest(req, res) {
       let body = '';
   
       for await (const chunk of req) {
           body += chunk.toString();
       }
   
       try {
           // Pipe the request data through secretlint
           const { stdout } = await execa('secretlint', ['-stdin'], { input: body });
           
           if (stdout.includes('ERROR')) {
               res.statusCode = 400;
               res.end(stdout);
               return;
           }
       } catch (error) {
           res.statusCode = 500;
           res.end();
           return;
       }
   
       // Proceed with sending the request to the LLM provider
       const { stdout } = await execa('curl', ['https://llm-provider.com', '--data-binary', body]);
       res.end(stdout);
   }
   
   module.exports = {
       handleRequest,
   };

   Explanation

   • handleRequest Function:
     • Reads the request body asynchronously.
     • Pipes the request data through secretlint.
     • If any errors are detected, returns a 400 status code with the error message.
     • If no errors are detected, proceeds to send the request to the LLM provider using curl.

   Conclusion

   The goal of integrating secretlint "on-the-fly" for requests to LLM providers involves several steps. Ensure proper configuration, create a middleware script if necessary, and thoroughly test the implementation. By following these guidelines, you can help maintain the security of sensitive information in your project.

   AI-generated content by issue-bot may be incorrect

   AI-generated content by issue-bot may be incorrect
6. crp4222 commented on May 13, 2026

   

   crp4222 (crp4222)

   on May 13, 2026

   More actions

   For runtime PII/secret detection before sending to LLM APIs, we built a proxy that handles this at the transport layer. Catches API keys, passwords, SSNs, credit cards, and personal names — using Presidio regex + OpenAI's privacy-filter ONNX model for contextual detection. The proxy approach means it works with any tool that talks OpenAI-compatible API, no per-tool integration needed: https://github.com/crp4222/PrivAiTe