DEV Community: Amedeo

Gitleaks Pre-Commit Hook

Amedeo — Tue, 09 Dec 2025 11:18:36 +0000

As a software engineer, sometimes when troubleshooting something I need to hardcode passwords locally to connect to DEV environments. Yeah, I could use environment variables and all that... but let's be honest - when you just want to quickly check something, hardcoding it is the fastest way. I know, I'm lazy.

Specifically, I was trying to verify that a password for connecting to Redis in DEV was correct. After adding it to the code and testing it, I had that sinking feeling about "what if I accidentally commit and push this?" That got me thinking - I really need to automate this check.

Initially I used TruffleHog and wrote a pre-commit hook script for it. But after chatting with a few colleagues, they suggested I have a look at Gitleaks instead. The key difference? TruffleHog tries to verify if secrets are actually valid, but that's not what I wanted. Even if something looks like a false positive, I want to be the one who decides that. Gitleaks just flags patterns and lets you deal with it - which is exactly the behavior I needed.

Now, Gitleaks does offer a pre-commit setup in their README, but that involves installing the pre-commit package manager and configuring it per repository. I work with over 100 repos. I need something simple that works globally across all of them, not something I have to set up individually for each project. Yes, I am still lazy..

So I wrote a script that does it all in one go.

What it does

Basically runs Gitleaks before every commit. If it finds something that looks like a secret (API keys, tokens, passwords, whatever), it blocks the commit. Simple.

One command to install:

curl -sSL https://raw.githubusercontent.com/AmedeoV/gitleaks-pre-commit-hook/refs/heads/main/gitleaks-local-git-pre-hook.sh | bash

Then it just works everywhere. All repos, automatically protected.

Why I like it

I don't have to think about it. That's the whole point. I code, I commit, if there's something sensitive in there, it stops me. Done.

It detects like 100+ different types of secrets out of the box. You can add custom rules too if you have specific patterns you want to catch.

One small annoyance

Sometimes it flags false positives. But you can bypass with --no-verify when you're sure it's safe. Haven't needed to do that often though.

Already saved me twice from pushing stuff I shouldn't. Feels good knowing it's there watching.

Link: github.com/AmedeoV/gitleaks-pre-commit-hook

🔎 Seraphix: The Scanner Toolkit That Led to F5 Security Researcher Recognition

Amedeo — Wed, 08 Oct 2025 15:14:32 +0000

I'm excited to introduce Seraphix, a comprehensive, open-source secret scanning toolkit I built to meet the needs of serious security researchers and bug bounty hunters.

Seraphix is designed for speed and scale, moving far beyond basic repository checks. It integrates multiple powerful scanning strategies—from organization-wide audits to finding data thought to be deleted forever—all managed through an efficient, customizable workflow.

Seraphix Core Capabilities: Beyond the Basics

Seraphix is built on four core pillars, giving you flexibility and power for any audit scenario:

1. Massive-Scale Organization Scanning

Seraphix can scan an entire list of GitHub organizations or target a single organization, fetching and processing repositories in parallel. It dynamically calculates the optimal number of workers to use on your system, ensuring scans are completed as quickly as possible.

2. The Force-Push Goldmine

This is our unique advantage. When a developer accidentally commits a secret and then performs a git push --force to delete it, the commit often becomes "dangling" but remains accessible. Seraphix uses a filtered GHArchive dataset to specifically identify these force-pushed commits and uncover secrets that other scanners miss.

To check and verify the integrity and validity of every secret found, Seraphix leverages the power of TruffleHog.

Watch Seraphix in action, hunting for secrets in a force-pushed commit:

💡 The Inspiration: The force-push scanning technique was directly inspired by the groundbreaking work of Sharon Brizinov. You can read the original post detailing how he scanned all of GitHub's "oops" commits and earned bounties here: How I Scanned All of GitHub’s "Oops" Commits for Leaked Secrets.

3. The Bug Bounty Utility

Looking for targets? Seraphix includes a powerful utility to fetch and generate lists of GitHub organizations known to offer bug bounty programs. You can then feed this curated list directly into the mass scanning module, streamlining your hunting workflow.

4. Targeted Repository and Commit Scanning

For focused investigation, you can easily target specific repositories or individual commits for a deep-dive analysis.

Analytics and Real-Time Notifications

Discovering secrets is only the first step. Seraphix ensures you can verify and act on your findings instantly.

Interactive Dashboard

Every scan generates a powerful, interactive web dashboard for visualization and analysis. It provides an at-a-glance view of:

Secret Statistics: Breakdown of secret types (e.g., AWS keys, tokens).
Risk Assessment: Severity and calculated risk associated with each finding.
Verification Status: Track which secrets have been verified as active.

Advanced Alerting System

You can enable real-time notifications to be alerted the moment a secret is found, without having to wait for the scan to finish. Seraphix supports instant alerts via:

Telegram
Discord
Email (Mailgun)

Quick Start: Get Seraphix Running in Minutes

Seraphix is primarily written in Shell and Python, making it highly portable and easy to deploy.

1. Installation

# Clone the repository
git clone https://github.com/AmedeoV/seraphix.git
cd seraphix

# Run the installation script to install dependencies
./install_requirements.sh

2. Choose Your Scanner (Example: Organization Scan)

To scan an organization (e.g., Microsoft) for the top 10 most recent repos, using parallel processing:

cd org-scanner/
./scan_org.sh microsoft --max-repos 10

👉 Check out the full documentation and source code here:
AmedeoV/seraphix on GitHub

🏆 Proven Results and Acknowledgment

The deployment and testing capabilities of Seraphix have been directly instrumental in my vulnerability discovery efforts. This work recently resulted in official acknowledgment by F5 in their SIRT Security Researcher Acknowledgement program.

Soak Testing with K6

Amedeo — Fri, 10 Mar 2023 14:06:18 +0000

What is Soak Testing

A soak test, it's like a load test that runs for an extended period. For the following examples I decided to use K6, an extensible testing tool.

Why is useful

Typically with a normal load test, we send a bunch of requests for a short period and monitor how the platform performs. While this may be useful for most scenarios, the typical load test might miss some issues that would come up only when the system is stressed for a long period. For example, during a major event, we might have a lot of clients using our platform for hours and this might cause problems related to memory leaks, logs filling up the disk space and so on...

Example of Web API with a memory leak

The following example has been taken from Microsoft Diagnostic Samples - This Web API will cause the target to leak memory (amount specified by {kb}).

Observe that by hitting the API Endpoint, the memory usage keeps growing (the GC Heap Size (MB) increases)

By running a conventional load test for a short period, it returns a 200 so we think that everything it's working as expected:

However, when we run a Soak Test for a long period, we notice that some of the requests are failing:

Investigating the exceptions we can see what the issue is:

System.OutOfMemoryException: Exception of type 'System.OutOfMemoryException' was thrown.

And this is the full stack trace:

fail: Microsoft.AspNetCore.Server.Kestrel[13]

      Connection id "0HMHUTUB1JJR6", Request id "0HMHUTUB1JJR6:00000003": An unhandled exception was thrown by the application.

      System.OutOfMemoryException: Exception of type 'System.OutOfMemoryException' was thrown.
         at System.Collections.Generic.List`1.set_Capacity(Int32 value)
         at System.Collections.Generic.List`1.AddWithResize(T item)
         at MemoryLeakApi.Controllers.MemoryLeakController.memleak(Int32 kb) in /src/Controllers/MemoryLeakController.cs:line 18
         at lambda_method1(Closure , Object , Object[] )
         at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.SyncObjectResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeActionMethodAsync()
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeNextActionFilterAsync()

      --- End of stack trace from previous location ---
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()

      --- End of stack trace from previous location ---
         at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|20_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
         at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
         at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
         at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
         at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)

Conclusion

As we can see, a conventional load test would have missed the issue (in this case a memory leak) - keep in mind that this was just an example.

In a real-world scenario, you would want to run a soak test for several hours on a lower environment or even in production if your application can handle it.

Then set some alerts on whatever monitoring software you use and check out the results to narrow down and fix any issues.

F# - C# Interop

Amedeo — Thu, 24 Feb 2022 09:52:10 +0000

What is Interop

Interoperability is the ability of two different systems to communicate with each other. In this case, it would be a C# and F# application communicating. Because they compile down to the same Intermediate Language we can reference F# projects in C# projects and vice versa.

Why is this useful

One of the benefits is that if you are planning to migrate your codebase from C# to F#, you can do it gradually by introducing some F# code without discarding any of the existing code base.

Sometimes we want to take advantage of the C# world, i.e. a lot of existing nuget packages are written in C# and we don't want to rewrite them in F#.

⚠️ Please note that all the observations listed on this page are valid for .NET 5 and below.

Example F# Application using C# library

In this example, we are going to create an F# application that uses a C# library.

The library simulates an IO operation with await Task.Delay(300, cancellationToken); and reverses the words sent.

C# Library

namespace WordReverserLibraryCsharp
{
    public static class WordReverser
    {
        public static async Task<string> WordReverserAsync(string sentence, CancellationToken cancellationToken)
        {
            await Task.Delay(300, cancellationToken);

            var words = sentence.Split(' ');
            Array.Reverse(words);

            return $"{string.Join(" ", words)}";
        }
    }
}

F# Application

namespace WordReverserConsoleAppFsharp

open System.Threading
open WordReverserLibraryCsharp

module WordReverserModule =
    let wordReverser (sentence: string) : Async<unit> =
        async {
            let cancellationTokenSource = new CancellationTokenSource(800);
            let! reversedWords =
                WordReverser.WordReverserAsync(sentence, cancellationTokenSource.Token)
                |> Async.AwaitTask
            printfn ($"{reversedWords}")
        }
    Async.Start(wordReverser("one two three"))        
    Async.RunSynchronously(Async.Sleep(1000))

Observations

To consume the C# library from F#, we have to convert the Task<T>returned from the library to Async<T> using Async.AwaitTask which waits for the Task to complete and returns its result as Async<T>. Read about Async.AwaitTask here

Just before the line Async.Start(wordReverser("one two three")) we still haven't invoked the operation, only done the setup to call wordReverser, to start the operation we can use Async.Start(wordReverser("one two three").

Example C# Application using F# library

In this example we are doing the opposite of the previous one: we create a C# application that uses an F# library.

F# Library

namespace WordReverserLibraryFsharp

open System.Threading
open System.Threading.Tasks

module WordReverserModule =

    let wordReverser (sentence: string, cancellationToken: CancellationToken) : Task<string> =
        let reverser =
            async {
                do! Async.Sleep(300)

                return
                    sentence.Split [| ' ' |]
                    |> Array.rev
                    |> String.concat " "
            }

    Async.StartAsTask(reverser, TaskCreationOptions.None, cancellationToken)

C# Application

using WordReverserLibraryFsharp;

namespace WordReverserConsoleAppCsharp
{
    internal static class Program
    {
        private static async Task Main()
        {
            var cancellationTokenSource = new CancellationTokenSource(400);
            var reversedWords = await WordReverserModule.wordReverser("one two three", cancellationTokenSource.Token);

            Console.WriteLine(reversedWords);
        }
    }
}

Observations

We can't use F# Async in C#, but the F# library can return a Task so that the C# application can consume it without any issues. We can achieve this by using Async.StartAsTask in .NET 5 and below.
Read about Async.StartAsTask here

It's good practice for any Async work in C#, to always pass a CancellationToken as an argument, while the F# code does not necessarily need one as the CancellationToken propagation is controlled by how the asynchronous work is kicked off and as a result, CancellationTokens may or may not be propagated. For example Async.Sleep doesn't accept a CancellationToken as a parameter.

Example C# Application using F# library handling exceptions

In this example, we are going to use an F# library from a C# application, handling exceptions and passing a CancellationToken.

F# Library

namespace FsharpLibraryComplete

open System.Threading
open System.Threading.Tasks

module FsharpLibraryCompleteModule =

    let wordReverser (sentence: string, raiseException: bool, cancellationToken: CancellationToken) : Task<string> =
        let reverser =
            async {
                do! Async.Sleep(300)
                if(raiseException) then
                    raise (System.Exception("wordReverser threw Exception"))
                return
                    sentence.Split [| ' ' |]
                    |> Array.rev
                    |> String.concat " "
            }

        Async.StartAsTask(reverser, TaskCreationOptions.None, cancellationToken)

C# Application

using FsharpLibraryComplete;

namespace ConsoleAppCsharpComplete;

internal static class Program
{
    private static async Task Main()
    {
        var cancellationTokenSource = new CancellationTokenSource(500);
        string reversedWords;

        try
        { 
            reversedWords = await FsharpLibraryCompleteModule.wordReverser("one two three", true, cancellationTokenSource.Token);
        }
        catch (Exception e)
        {
            Console.WriteLine(e);
            throw;
        }

        Console.WriteLine(reversedWords);
    }
}

Console output

System.Exception: someAsyncFunction threw Exception
   at FsharpLibraryComplete.FsharpLibraryCompleteModule.wordReverser@12-1.Invoke(Unit _arg1) in C:\projects\InteropPlayGround\Docker\ConsoleAppCsharpComplete\FsharpLibraryComplete\FsharpLibraryComplete.fs:line 13
   at Microsoft.FSharp.Control.AsyncPrimitives.CallThenInvokeNoHijackCheck[a,b](AsyncActivation`1 ctxt, b result1, FSharpFunc`2 userCode) in D:\a\_work\1\s\src\fsharp\FSharp.Core\async.fs:line 464
   at Microsoft.FSharp.Control.Trampoline.Execute(FSharpFunc`2 firstAction) in D:\a\_work\1\s\src\fsharp\FSharp.Core\async.fs:line 104
--- End of stack trace from previous location ---
   at ConsoleAppCsharpComplete.Program.Main() in C:\projects\InteropPlayGround\Docker\ConsoleAppCsharpComplete\ConsoleAppCsharpComplete\Program.cs:line 14
Unhandled exception. System.Exception: someAsyncFunction threw Exception
   at FsharpLibraryComplete.FsharpLibraryCompleteModule.wordReverser@12-1.Invoke(Unit _arg1) in C:\projects\InteropPlayGround\Docker\ConsoleAppCsharpComplete\FsharpLibraryComplete\FsharpLibraryComplete.fs:line 13
   at Microsoft.FSharp.Control.AsyncPrimitives.CallThenInvokeNoHijackCheck[a,b](AsyncActivation`1 ctxt, b result1, FSharpFunc`2 userCode) in D:\a\_work\1\s\src\fsharp\FSharp.Core\async.fs:line 464
   at Microsoft.FSharp.Control.Trampoline.Execute(FSharpFunc`2 firstAction) in D:\a\_work\1\s\src\fsharp\FSharp.Core\async.fs:line 104
--- End of stack trace from previous location ---
   at ConsoleAppCsharpComplete.Program.Main() in C:\projects\InteropPlayGround\Docker\ConsoleAppCsharpComplete\ConsoleAppCsharpComplete\Program.cs:line 14
   at ConsoleAppCsharpComplete.Program.<Main>()

Observations

Running the code as it is, will raise an exception from the F# library that gets caught by the C# application.

Please note that if the Task gets cancelled before raising the exception on the F# library, the C# application will catch the exception as System.Threading.Tasks.TaskCanceledException: A task was canceled.

Conclusion

It's not particularly difficult to use F# libraries in a C# application and vice versa, but there are a few things that we have to keep in mind, i.e. C# does not work with F# Async, instead, we have to add additional steps to convert Async into a Task.