Earlybird

Earlybird. (Amex, Go) scans repositories for secrets, PII, weak crypto, and key material in source, comments, and committed files.

Blurb

EarlyBird is a sensitive data detection tool capable of scanning source code repositories for clear text password violations, PII, outdated cryptography methods, key files and more. - americanexpre…

Summary

Garden stance: We assess Earlybird for our estate.

Key points:

Example false-positive rule (ignore rules 1, 2, 4 when pattern abc matches):

1
2
3
4
5
6
7
8

{
  "rules": [{
    "Codes": [1, 2, 4],
    "Pattern": "abc",
    "FileExtensions": [],
    "Description": "Just because"
  }]
}

Rules apply when both Pattern and FileExtensions match (empty FileExtensions = all extensions). To disable a code entirely, use pattern .*. To skip markdown: "FileExtensions": [".md"].

Pilot snapshot (internal, 2024): 21 false positives, 19 valid, 3 noise; re-run after rule tuning before org mandate.

Pipeline placement: same PR path as lint (Continuous Integration step 5 in garden CI model); do not rely on scanner alone without secret rotation process.

References

• americanexpress/earlybird
• Usage
• Hooks (pre-commit)

Details

Example false-positive rule (ignore rules 1, 2, 4 when pattern abc matches):

1
2
3
4
5
6
7
8

{
  "rules": [{
    "Codes": [1, 2, 4],
    "Pattern": "abc",
    "FileExtensions": [],
    "Description": "Just because"
  }]
}

Rules apply when both Pattern and FileExtensions match (empty FileExtensions = all extensions). To disable a code entirely, use pattern .*. To skip markdown: "FileExtensions": [".md"].

Pilot snapshot (internal, 2024): 21 false positives, 19 valid, 3 noise; re-run after rule tuning before org mandate.

Pipeline placement: same PR path as lint (Continuous Integration step 5 in garden CI model); do not rely on scanner alone without secret rotation process.

References

• americanexpress/earlybird
• Usage
• Hooks (pre-commit)