From 3322bb3ce75e5788cc08242ecae54f9e5d1ef7dc Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Fri, 16 Oct 2026 17:26:54 +0800 Subject: [PATCH] feat: add betterleaks to Supply Chain Security > Secret Scanning Leaked secrets are a supply chain risk that dependency audits don't cover, so Supply Chain Security splits into Dependency Audits and Secret Scanning. Co-Authored-By: Claude --- README.md | 9 ++++++--- website/data/pypi_name_overrides.json | 1 + 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 2cd7fa64..ee4bd8ff 100644 --- a/README.md +++ b/README.md @@ -1163,10 +1163,13 @@ _Frameworks and tools for penetration testing._ ### Supply Chain Security -_Tools for auditing dependencies against known vulnerabilities._ +_Tools for auditing dependencies against known vulnerabilities and scanning for leaked secrets._ -- [pip-audit](https://github.com/pypa/pip-audit) - Audits Python environments and dependency trees for known vulnerabilities, using the Python Packaging Advisory Database or OSV. -- [uv-audit](https://github.com/astral-sh/uv) - (part of uv) uv's [dependency vulnerability scanning](https://docs.astral.sh/uv/reference/cli/#uv-audit) backed by OSV. +- Dependency Audits + - [pip-audit](https://github.com/pypa/pip-audit) - Audits Python environments and dependency trees for known vulnerabilities, using the Python Packaging Advisory Database or OSV. + - [uv-audit](https://github.com/astral-sh/uv) - (part of uv) uv's [dependency vulnerability scanning](https://docs.astral.sh/uv/reference/cli/#uv-audit) backed by OSV. +- Secret Scanning + - [betterleaks](https://github.com/betterleaks/betterleaks) - Finds leaked secrets in git history, directories, and files, from the original author of gitleaks. ### Web Security diff --git a/website/data/pypi_name_overrides.json b/website/data/pypi_name_overrides.json index 184197e7..0ee6dfa6 100644 --- a/website/data/pypi_name_overrides.json +++ b/website/data/pypi_name_overrides.json @@ -1,6 +1,7 @@ { "autobahn-python": { "package": "autobahn", "reason": null }, "azure-sdk-for-python": { "package": null, "reason": "monorepo umbrella; ships as many azure-* packages, no single package represents it", "badge": "Multiple on PyPI" }, + "betterleaks": { "package": null, "reason": "not published on PyPI" }, "cloud-init": { "package": null, "reason": "installed via distro images, not pip" }, "concurrent-futures": { "package": null, "reason": "stdlib module" }, "conda": { "package": null, "reason": "installed via Miniforge or Anaconda installers; PyPI conda is a stale 2017 upload" },