Exposed Secrets Scanner

This project provides a centralized and automated way to scan selected Bitbucket repositories for leaked secrets (e.g., API keys, passwords, tokens) using the open-source TruffleHog tool. It is designed to run in Bitbucket Pipelines and send summary results to a Microsoft Teams channel.

---

What It Does

• Clones and scans specific Bitbucket repositories
• Uses TruffleHog to detect verified secrets
• Scans all branches and full commit history
• Sends a clean, concise summary of results to a Teams channel
• Produces JSON reports as downloadable artifacts

---

Project Structure

.
├── bitbucket-pipelines.yml    # Defines the pipeline and scanning steps
├── ignore_repos.txt           # list of repos that should not be scanned
├── scan_repos.sh              # Script to clone & scan selected repos
├── notify_teams.sh            # Script to summarize results & send to Teams
└── reports/                   # Auto-generated scan reports (JSON)

---

Configuration

1. Repository Variables (Bitbucket)

Go to Repository Settings → Repository Variables, and add the following:

Variable Name	Description	Example / Notes
TEAMS_WEBHOOK_URL	Incoming webhook for Microsoft Teams	Get from your Teams channel
BB_USERNAME	(If scanning private repos) Your Bitbucket username	Optional unless using HTTPS auth
BB_APP_PASSWORD	(If scanning private repos) Bitbucket App Password	See Bitbucket → App Passwords

---

Usage

Manual Run (Trial)

To scan the configured repositories manually:

1. Commit changes to main
2. Go to Bitbucket → Pipelines → Run Pipeline
3. Select main Branch
4. Select custom: trufflehog-scan-selected Pipeline
5. Click Run

Scheduled Scans

To run scans daily or weekly:

1. Go to Repository Settings → Pipelines → Schedules
2. Add a new schedule:
   • Branch: main
   • Pipeline: exposed-secrets-scanner
   • Frequency: Daily or Weekly

---

Editing Repositories to Scan

To scan specific repositories, edit the list inside scan_repos.sh:

REPOS=(
  "https://bitbucket.org/your-org/repo-one.git"
  "https://bitbucket.org/your-org/repo-two.git"
)