Credentialdigger

Latest version: v4.14.4

Safety actively analyzes 682387 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 2 of 4

4.6.0

`git_username` authentication

We add an optional parameter `git_username` that can be set to authenticate in order to perform a scan.
While this parameter is not mandatory for GitHub (neither .com nor enterprise), it is needed for some private git servers and for private bitbucket repos.

If the `git_token` is not set, this parameter is ignored (since the tool cannot authenticate with a username without token).
On the contrary, if the `git_token` is set, the username used for authenticating the tool is either `git_username` (if set) or `oauth2` (the default value, which is the one adopted by github)

The `git_username` parameter is supported not only in the python library but also in the CLI and in the UI (with a new optional input field).


Minor
- Fix dependencies for tensorflow
- Fix the double "category" input field in the UI (`add_rule`)
- Make the `export_discoveries` more efficient by not loading all the discoveries of a repo (unless needed)

4.4.0

With this release we restructure the ML models in order to improve their precision. Moreover, the new models will be directly integrated in the project, overcoming the painful download&linking needed for the former ones.

All the changes are transparent to the final user (i.e., no API or function definition changed), thus there was no need for a major upgrade to v5.

Path Model
We decided to deprecate the fasttext approach and shifted to the usage of a regex to filter out false positive file paths. Indeed, according to our tests, we noticed that we can keep a good precision while decreasing the overhead

~SnippetModel~ PasswordModel
We decided to deprecate the old fasttext double-model (extractor+classifier) approach in order to shift to a NLP approach based on CodeBERT. Overall, it's slower but way more precise, even if it only works for password. Hence, the change of name from *SnippetModel* to *PasswordModel*.
Moreover, since the PasswordModel only works for passwords, we added a check in the Client to only run this model over password discoveries.

AoB
- The `download` function has been deprecated and models are managed automatically by Credential Digger
- The generator was strongly linked to the SnippetModel, so it has been deprecated
- The documentation has been updated, both in the README and in the wiki
- We added a `categories` enum in the postgres db in order to drive the users to 4 main rule categories. Nevertheless, this enum is only enforced in new postgres installations to make the transition smoother
- The UI has been updated to use the new models
- We ported the incremental `scan_snapshot` from v4.3.1
- Minor bug fixes
- Refresh the UI every 8s (was 5s)

---

Credits also go to the wonderful work from melisande1

4.2.0

Docker
- Upgrade the base image of the docker containers to adopt python3.9 (was 3.7) (Docker upgrade 141)
- Name the images for the backend with sqlite and postgres accordingly
- Update instructions on the wiki

AoB
- A bug preventing the use of the similarity model with postgres has been fixed
- Some Dependencies versions have been updated

4.1.0

New features:
- export discoveries in a csv file
- Add tests for get_discoveries

Minor improvements and fixes:
- reduce tensorflow warnings
- improve dependency management
- Fix docker container for Windows
- Minor UI fixes

4.0.2

Fix 162

4.0.1

Minor update with bugfixing:
- _"Show on GitHub"_ button with snapshots has been fixed (157 )
- The discoveries view for a single file has been fixed (163 )

Page 2 of 4

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.