Lion Cipher Lab
Search code with ripgrep, and catch the secrets its fast defaults skip
- Foundations
- Beginner
- ~60 min
- Free · no account required
Why it matters
Searching a codebase is something you will do every working day in security: finding where a config value is set, which files call a risky function, every IP address in a repo you were just handed, or whether anyone pasted a password into the code. ripgrep (the command is rg) has become the default tool for that job because it is fast and it hides noise. The catch is how it hides noise: by default it skips everything your .gitignore lists, every hidden file and folder, and every binary file. That is great for reading code and dangerous for security work, because the files most likely to hold…
What you'll learn
- installing ripgrep (rg) on Windows, macOS or Linux and confirming the version
- knowing the four things rg skips by default: .gitignore'd paths, hidden files and folders, binary files, and symlinks
- peeling those filters off one at a time with -u, -uu and -uuu, and measuring what each layer hides against an answer key
- spotting a file that is ignored AND committed with git ls-files -ci --exclude-standard
- daily flags: -t and -g to narrow by file type or glob, -l, -c, -o, -F for literal text, -f for a pattern file, --json for scripts
- regex shapes for IPv4 addresses and AWS-style access key ids, and the false positives they bring
- a small rg-based pre-commit hook, and three measured ways it still lets a secret through
- when rg is the right tool, when grep is, and when only a dedicated scanner like gitleaks will do
Steps in this lab
- The words first: what ripgrep is and the one trap this lab measures
- Open a terminal, check Git and Python, make a lab folder
- Install ripgrep and confirm the version
- Build the practice repo and the scorer
- Look before you search: what Git tracks, what it ignores, and the file that is both
- Measure 1, the baseline: grep -r searches everything
- Measure 2: rg with its defaults finds 2 of 9
- Measure 3: peel the filters off one layer at a time
- Measure 4: speed on a bigger tree, and where the speed really comes from
- Daily patterns: narrow, count, extract, and search literally
- --json: results a script can trust
- The security job: a small pre-commit gate with rg
- Honest negatives: three ways a secret still gets past you
- Judgment: rg, grep, or a scanner, and how a pro sets this up