secret-detection

# Skill: Secret Detection > **Expertise:** trufflehog, gitleaks, git-secrets, pre-commit hooks, CI scanning, secret rotation playbook. ## When to load When setting up secret scanning pre-commit or in CI, investigating a potential credential leak, or remediating secrets found in git history. ## Pre-Commit Hook Setup ```bash # Install pre-commit pip install pre-commit # .pre-commit-config.yaml repos: - repo: https://github.com/trufflesecurity/trufflehog rev: v3.88.0 hooks: - id: trufflehog name: TruffleHog — secret scan entry: trufflehog git file://. --since-commit HEAD --only-verified --fail language: system pass_filenames: false - repo: https://github.com/gitleaks/gitleaks rev: v8.21.0 hooks: - id: gitleaks name: Gitleaks — detect hardcoded secrets ``` ```bash # Install hooks for all team members (add to onboarding docs) pre-commit install pre-commit install --hook-type commit-msg # Run against all files (one-time audit) pre-commit run trufflehog --all-files pre-commit run gitleaks --all-files ``` ## CI: trufflehog (GitHub Actions) ```yaml - name: Scan for secrets (trufflehog) uses: trufflesecurity/trufflehog@main with: path: ./ base: ${{ github.event.repository.default_branch }} head: HEAD extra_args: > --only-verified --fail --format json --json-output trufflehog-results.json continue-on-error: false # hard fail - name: Upload results if: fa...