SniffPup VS Gitrob

• Leaked API key detection
  Finds API keys and secrets exposed in page HTML and JS bundles
• Exposed .env / .git file check
  Checks for publicly reachable .env and .git files
• Source map exposure check
  Checks for public source maps
• Security headers check
  Checks security headers
• Cookie security check
  Checks cookie flags
• SSL/TLS check
  Checks HTTPS and TLS certificate
• CORS check
  Checks CORS configuration
• Email DNS (SPF/DMARC) check
  Checks SPF and DMARC records
• Supabase / Firebase open-read check
  Checks whether an anonymous visitor can read data
• No-signup free scan
  Free scan needs no signup
• AI fix prompts
  Copy-paste fix prompts for AI builders
• PDF / Markdown reports
  Downloadable reports
• Scheduled re-scans / monitoring
  Ongoing re-scans on paid plans

• Open Source
  Gitrob is an open-source tool, which means it's free to use and its source code can be reviewed and modified by anyone, providing transparency and flexibility for users.
• Sensitive Data Detection
  Gitrob is designed to help detect potentially sensitive information in repositories, such as API keys, credentials, and other secrets, thus enhancing security.
• Automation
  The tool automates the scanning of repositories, making it easier and faster to identify potential security risks without the need for manual code reviews.
• Integration with GitHub
  Gitrob integrates directly with GitHub, allowing seamless scanning of GitHub repositories for sensitive information.

Possible disadvantages

• Limited to GitHub
  Gitrob primarily focuses on GitHub repositories, which may limit its usefulness if you need to scan repositories hosted on other platforms such as GitLab or Bitbucket.
• Requires Setup and Configuration
  Users must set up and configure Gitrob to use it effectively, which may require time and understanding of its requirements and environment.
• Potential for False Positives
  Like many automated tools, Gitrob can sometimes produce false positives, leading to time spent on investigating results that are not actual threats.
• Maintenance and Updates
  As an open-source project, Gitrob's updates and maintenance depend on community contributions, which might not be as frequent or comprehensive as commercial alternatives.

• How to find exposed API keys on your website (a 7-step check)

  A free SniffPup scan of your live URL runs these outside checks: secrets in your HTML and same-origin JS (always masked), public .env/.git files (variable names only, never values), downloadable source maps, security headers and more.... - Source: dev.to / 13 days ago

• Supabase RLS policy examples: copy-paste policies for 7 common app patterns

  These examples are a starting point, not a review of your app. Got a pattern we missed? Tell us: https://sniffpup.com/suggest. - Source: dev.to / 13 days ago

• Show HN: No Secrets Quickly find sensitive files in your GitHub repo

  There are a ton of them, here are a few: https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://github.com/awslabs/git-secrets https://github.com/sirwart/ripsecrets... - Source: Hacker News / over 4 years ago