Yelp detect-secrets test_data/

Yelp detect-secrets’ curated credential fixture corpus.

Upstream: https://github.com/Yelp/detect-secrets
Pinned commit: 01886c8a910c64595c47f186ca1ffc0b77fa5458
Reference: v1.5.0 release tag
Baseline scan date: 2026-05-17

Vulnerabilities brass detects

These are the specific lines brass catches in this codebase. Re-running brass at the pinned commit reproduces each one. 6 required findings:

File	Line	Category	Detected by	CWE / Bandit ID
`each_secret.py`	6	hardcoded_credential	`SecretsScanner`	Basic Auth Credentials in URL (CWE-798)
`each_secret.py`	8	hardcoded_credential	`SecretsScanner`	AWS Access Key (CWE-798)
`each_secret.py`	9	hardcoded_credential	`SecretsScanner`	AWS Secret Access Key (CWE-798)
`each_secret.py`	4	hardcoded_credential	`SecretsScanner`	High Entropy Base64 String (CWE-798)
`each_secret.py`	5	hardcoded_credential	`SecretsScanner`	High Entropy Hex String (CWE-798)
`config.ini`	32	hardcoded_credential	`SecretsScanner`	Keyword-based Secret Detection (CWE-798)

Documented vulnerabilities brass doesn’t yet catch

Honest list of gaps — vulnerabilities documented upstream but missed by brass’s current scanner set. We publish these so customers see the full picture, not just successes. 3 aspirational entries:

File	Line	Category	What brass doesn’t catch yet
`each_secret.py`	99	hardcoded_credential	GitHub PAT (ghp_…) — no fixture in test_data/
`each_secret.py`	99	hardcoded_credential	Stripe sk_live_… — no fixture in test_data/
`each_secret.py`	99	hardcoded_credential	JWT eyJ… — no fixture in test_data/

Reproduce locally

git clone https://github.com/Yelp/detect-secrets.git project
cd project && git checkout 01886c8a910c64595c47f186ca1ffc0b77fa5458
brasscoders --offline scan .

Then check .brass/detailed_analysis.yaml for the listed findings.