How do you find secrets or passwords that might have been accidentally checked into Bitbucket?

[Mohammed Davoodi [Soteri]]

How do we make sure we don't have any developers who have checked in passwords or secrets into code accidentally?

[Mohammed Davoodi [Soteri] · Accepted solution]

You can use credentials scanning solutions comb through git repositories and flag anything sensitive that was committed in error.

For Bitbucket, you can use our app Security for Bitbucket. Security for Bitbucket streamline this process. Scans can be performed, reviewed, and dispositioned without scripting or setting up an external service. Security for Bitbucket also integrates with Bitbucket’s hook architecture to block any dangerous incoming commits. Without such an integration, committed secrets can only be caught after the fact, and must be considered compromised and rotated out.