How do i exclude a single secret from truffleHog scan in pipeline?

Question

Eg.: I have a file mycode.py which contains 2 secrets

myfakesecret : "ANSAJHSAKDKDMKADKAMCKSMKSMCKSCC"
MyOriginalSecret: "H%&&^DBSHDBHBBBS%^&&&DSD2343"

I want to ignore myfakesecret but not MyOriginalSecret in truffleHog scan.

If I use --exclude_paths exclude-patterns.txt where exclude-patterns.txt contains mycode.py then truffle hog scan will ignore both secrets.

Can I specify a secret hash or name or any other way to exclude secret not complete file so that it should ignore a particular secret?

VonC_6309 · Answer

Ideally, your code does not include the sensitive secret at all.
That way, truffleHog scan has nothing to ignore/exclude.

mycode.py should read that secret from a file/source outside the repository, at runtime (when you are executing the program.