diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000000..e065f2ee1b --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,88 @@ +# Global allowlist +[allowlist] +paths = [ + '''node_modules''', + '''.git''' +] + +# Custom rules +[[rules]] +id = "alchemy-api-key" +description = "Alchemy API Key" +regex = '''https://[a-zA-Z0-9-]+\.g\.alchemy\.com/v2/[a-zA-Z0-9_-]+''' +keywords = [ + "alchemy", + "alchemy.com" +] +tags = ["key", "Alchemy"] + +[[rules]] +id = "ankr-api-key" +description = "Ankr API Key" +regex = '''https://rpc\.ankr\.com/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+''' +keywords = [ + "ankr", + "rpc.ankr.com" +] +tags = ["key", "Ankr"] + + +[[rules]] +id = "tenderly-api-key" +description = "Tenderly API Key" +regex = '''https://[a-zA-Z0-9-]+\.gateway\.tenderly\.co/[a-zA-Z0-9_-]+''' +keywords = [ + "tenderly", + "gateway.tenderly.co" +] +tags = ["key", "Tenderly"] + +[[rules]] +id = "quicknode-api-key" +description = "QuickNode API Key" +regex = '''https://[a-zA-Z0-9-]+\.[a-zA-Z0-9-]+\.quiknode\.pro/[a-zA-Z0-9]+''' +keywords = [ + "quiknode", + "quiknode.pro" +] +tags = ["key", "QuickNode"] + +[[rules]] +id = "drpc-api-key" +description = "DRPC API Key" +regex = '''https://lb\.drpc\.org/[a-zA-Z0-9]+\?.*dkey=[a-zA-Z0-9]+''' +keywords = [ + "drpc", + "drpc.org" +] +tags = ["key", "DRPC"] + +[[rules]] +id = "dwellir-api-key" +description = "Dwellir API Key" +regex = '''https://api-.*\.dwellir\.com/[a-zA-Z0-9-]+''' +keywords = [ + "dwellir", + "dwellir.com" +] +tags = ["key", "Dwellir"] + +[[rules]] +id = "startale-api-key" +description = "Startale API Key" +regex = '''https://[a-zA-Z0-9.-]+\.startale\.com.*\?apikey=[a-zA-Z0-9]+''' +keywords = [ + "startale", + "startale.com" +] +tags = ["key", "Startale"] + +[[rules]] +id = "grove-city-api-key" +description = "Grove City API Key" +regex = '''https://[a-zA-Z0-9-]+\.rpc\.grove\.city/v1/[a-zA-Z0-9]+''' +keywords = [ + "grove", + "grove.city" +] +tags = ["key", "Grove City"] diff --git a/.husky/pre-commit b/.husky/pre-commit index 9edc7156ee..49f096ef27 100755 --- a/.husky/pre-commit +++ b/.husky/pre-commit @@ -1,6 +1,16 @@ #!/usr/bin/env sh . "$(dirname -- "$0")/_/husky.sh" +# Check for potential secrets in staged files +echo "🔍 Checking for potential secrets in staged files..." +if git diff --cached --name-only | xargs gitleaks protect --staged --verbose --redact --config .gitleaks.toml; then + echo "✅ No secrets detected" +else + echo "❌ Potential secrets detected in your changes!" + echo "Please remove any secrets, credentials, or sensitive information before committing." + exit 1 +fi + yarn lint-staged echo "📝 If you haven't yet, please add a changeset for your changes via 'yarn changeset'" diff --git a/README.md b/README.md index 481d0b9060..d2c8215e37 100644 --- a/README.md +++ b/README.md @@ -32,6 +32,10 @@ To read more about interchain applications, how the protocol works, and how to i You need `jq` installed on your machine. You can download it from [official page](https://jqlang.github.io/jq/download/) or use a package manager of your choice. +#### Install `gitleaks` + +You need `gitleaks` installed on your machine. You can download it from [official page](https://github.com/gitleaks/gitleaks) or use a package manager of your choice. + #### Foundry First ensure you have Foundry installed on your machine.