Zach Rice

The Dig

October 1, 2024

Hacktoberfest 2024: Detector Improvement Competition at Truffle Security!

Hacktoberfest 2024: Detector Improvement Competition at Truffle Security!

Zach Rice

October 1, 2024

It's that time of the year again—Hacktoberfest 2024 is here! Last year, we were thrilled to receive 82 contributions and add 31 new detectors to TruffleHog. We had a blast collaborating with the community.

This Hacktoberfest, we're emphasizing detector improvements. While new detectors are valuable, improving existing ones ensures better accuracy and reliability for all users.

Competition Rules and Notes

  • Submission Period: October 1, 2024 – October 31, 2024.

  • First Come, First Served: If multiple PRs address the same detector fix, only the first one submitted will be considered.

  • One Contribution per PR: Each pull request should focus on a single detector improvement.

  • No Spam: Spammy or invalid contributions will be marked accordingly and will not be eligible for points.

  • Abandoned PRs: If requested changes are not made within 3 days, the PR will be considered abandoned.

  • Opting Out: If you prefer not to participate in the competition, simply avoid applying the competition labels to your PR.

Detector Improvement Categories and Acceptance Criteria

Merged PRs will award the author with 1 point. At the end of the submission period we will tally all the points and announce the top three winners. For a PR to be considered it must meet one of the following categories:

  • Correct verification logic.

  • Correct verification endpoints.

  • Correct the regular expressions used for secret detection.

  • Introduce detector versioning if the provider has multiple versions for their API.

The PR must also satisfy the following Acceptance Criteria:

  1. Provide screenshots or log outputs of passing tests. This includes a local test of the detector actually receiving a 2xx (i.e, proving verification).

  2. Provide supporting evidence for the validity of the Detector’s regular expressions

    1. screenshot of partially redacted and ideally rotated secret and/or api docs (example)

Prizes

We're excited to offer the following prizes to the top contributors:

  1. First Prize: 13-inch MacBook Air (M3) or $1,000 Amazon Gift Card

  2. Second Prize: Timbuk2 Backpack or $300 Amazon Gift Card

  3. Third Prize: Custom TruffleHog Swag or $100 Amazon Gift Card

Winners can choose between the physical prize or an equivalent gift card.

Getting Started

  1. Fork the TruffleHog Repository.

  2. Introduce a change that improves an existing detector.

  3. Commit and push your changes to your fork.

  4. Create a Pull Request.

  5. Sign the CLA.

  6. Wait for a review.

Happy Hacking!