Detecting security keys

You should never store security keys in a version-control system. Cloud Source Repositories can help you prevent users from storing security keys in a Google Cloud repository. Cloud Source Repositories can check for the following types of security keys:

• Google Cloud service account credentials (JSON format)
• PEM-encoded private keys (including RSA, DSA, and PGP)

This checking feature is available for all repositories at no charge.

How the security-key checking feature works

When a user executes a git push command, the checking feature looks for data that might be a security key. If a match is found, the feature blocks the git push and notifies users what was found and where. For example:

 The push has been rejected because we detect that it contains a private key. Please check the following commands and confirm that it's intentional: git show [COMMIT] You can use `git rev-list --objects --all` to find the files. To push these files, please run `git push -o nokeycheck`. 

Before you begin

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Go to project selector

Disable security key detection

To disable security key detection, use the following gcloud command:

 gcloud init gcloud source project-configs update --disable-pushblock 

Enable security key detection

To enable private key detection, use the following gcloud command:

 gcloud init gcloud source project-configs update --enable-pushblock 

Override security key detection

To override the security key detection feature, use the following git command:

 git push -o nokeycheck 

What's next

After you set up a Google Cloud repository, you might find the following topics helpful:

• Controlling access to repositories
• Using the source browser