implementing-secret-scanning-with-gitleaks

# Implementing Secret Scanning with Gitleaks ## When to Use - When developers may accidentally commit API keys, passwords, tokens, or private keys to repositories - When establishing pre-commit gates that prevent secrets from entering the git history - When scanning existing repository history for previously committed secrets that need rotation - When compliance requirements mandate secret detection across all source code repositories - When migrating from manual secret audits to automated continuous scanning **Do not use** for detecting secrets in running applications or memory (use runtime secret detection), for managing secrets after detection (use Vault or AWS Secrets Manager), or for scanning container images (use Trivy or Grype). ## Prerequisites - Gitleaks v8.18+ installed via binary, Go install, or Docker - Pre-commit framework installed for local hook integration - Git repository with history to scan - CI/CD platform access (GitHub Actions, GitLab CI, or equivalent) ## Workflow ### Step 1: Install and Run Initial Repository Scan Perform a baseline scan of the repository to identify all existing secrets in the git history. ```bash # Install Gitleaks brew install gitleaks # macOS # or download binary from https://github.com/gitleaks/gitleaks/releases # Scan entire git history for secrets gitleaks detect --source . --report-format json --report-path gitleaks-report.json -v # Scan only staged changes (for pre-commit) gitleaks protect --staged --report-format ...