Scan for secrets locally and in CI

No single scanner catches everything, so OWASP recommends scanning at two levels: at the developer level (editor or pre-commit hook) and again in CI. Each layer catches what the other misses. Free tools such as Gitleaks and TruffleHog detect common key formats and high-entropy strings.

Set it up in three steps:

1. Add the Gitleaks hook through the pre-commit framework, so a secret never reaches a commit.
2. Add a CI job that fails the build if a secret is found, for anyone whose hook is missing or skipped.
3. Run a one-time scan of your full history to find old leaks you did not know about.

Any secret the history scan finds should be handled like a fresh leak: revoke and rotate it first.

# scan the repository and its git history
gitleaks git -v

# scan files on disk, ignoring git history
gitleaks dir -v .

# .pre-commit-config.yaml (then run: pre-commit install)
# repos:
#   - repo: https://github.com/gitleaks/gitleaks
#     rev: <pinned-release-tag>
#     hooks:
#       - id: gitleaks