diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 2c9e14c..4fba077 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -96,19 +96,19 @@ jobs: FOUND=0 echo "Checking for seed phrases / mnemonics..." - if grep -rn --include="*.kt" --include="*.java" --include="*.xml" -iE "(mnemonic|seed_phrase)\s*=\s*\"[a-z]+" . | grep -v /build/ | grep -v /test/ | grep -v "R.string" | grep -v "getString"; then + if grep -rn --include="*.kt" --include="*.java" --include="*.xml" -iE "(mnemonic|seed_phrase)\s*=\s*\"[a-z]+" . | grep -v /build/ | grep -v /test/ | grep -v /androidTest/ | grep -v "R.string" | grep -v "getString"; then echo "::error::Possible seed phrase found in source" FOUND=1 fi echo "Checking for private keys..." - if grep -rn --include="*.kt" --include="*.java" -E "0x[a-fA-F0-9]{64}" . | grep -v /build/ | grep -v /test/ | grep -v "chainId\|genesisHash\|chainGenesis"; then + if grep -rn --include="*.kt" --include="*.java" -E "(private_key|privateKey|secret)\s*=\s*\"0x[a-fA-F0-9]{64}\"" . | grep -v /build/ | grep -v /test/ | grep -v /androidTest/; then echo "::error::Possible private key found in source" FOUND=1 fi echo "Checking for API keys in source..." - if grep -rn --include="*.kt" --include="*.java" -iE "(api_key|apikey|secret_key|password)\s*=\s*\"[^\"]{16,}" . | grep -v /build/ | grep -v /test/ | grep -v BuildConfig | grep -v "process"; then + if grep -rn --include="*.kt" --include="*.java" -iE "(api_key|apikey|secret_key|password)\s*=\s*\"[^\"]{16,}" . | grep -v /build/ | grep -v /test/ | grep -v /androidTest/ | grep -v BuildConfig | grep -v "process"; then echo "::error::Possible API key or password found in source" FOUND=1 fi