Community Note

Please vote on this issue by adding a 👍 reaction to help prioritize this request.

Description

Many popular web frameworks use application secret keys that are critical for security (session signing, CSRF protection, encryption). These secrets are often accidentally committed in .env files or configuration files and represent a significant security risk.

Currently, TruffleHog does not detect these framework-specific secrets. Adding detectors for them would help catch a common class of security vulnerabilities.

Frameworks and Patterns

Security Impact

These secrets enable attackers to:

• Forge session cookies - Impersonate any user
• Bypass CSRF protection - Execute state-changing actions
• Decrypt sensitive data - Access encrypted cookies/tokens
• RCE in some cases - Laravel's encrypted cookies can lead to RCE via deserialization

Real-world Context

During a security audit of a GitHub organization, I found multiple exposed APP_SECRET values in .env files that TruffleHog did not detect. These secrets were in git history and still active.

Preferred Solution

Add new detectors for framework secret keys with:

1. Pattern matching based on the well-defined formats above
2. Keyword context to reduce false positives (e.g., require APP_SECRET= prefix)
3. File path hints (.env, settings.py, config/app.php, etc.)

Since these secrets cannot be verified via API, they would be "unverified" detectors but with high confidence due to the strict patterns.

Implementation Notes

Based on the Adding Detectors documentation:

• These would be unverified detectors (no API to validate against)
• High signal patterns with low false positive rates
• Could be implemented as a single "FrameworkSecretKey" detector with version support, or as separate detectors per framework

Additional Context

Sourcing Guidelines compliance:

• ✅ These frameworks host data (sessions, user data)
• ✅ Many have paid services (Laravel Forge, Symfony Cloud, etc.)

Example regex for Symfony:

var keyPat = regexp.MustCompile(`APP_SECRET[=:]\s*['"]?([a-f0-9]{32,})['"]?`)

References

• Symfony APP_SECRET documentation
• Laravel APP_KEY documentation
• Django SECRET_KEY documentation
• Rails secret_key_base documentation
• Laravel RCE via APP_KEY