Secret scanning
Finds credentials and tokens in the working tree and in history before they are pushed or published.
Sub-techniques
3
| ID | Name | Description |
|---|---|---|
V1008.001 | Pre-commit secret scan | Block the commit locally, before the secret reaches a remote. |
V1008.002 | History scan | Scan full git history, since deleting a secret in a later commit does not remove it. |
V1008.003 | Live verification | Test whether a found credential is still valid to prioritise rotation. |
Craft it
- Add a pre-commit hook and a CI job running the same scanner and config.
- Keep a baseline or allow-list for test fixtures, reviewed like code.
- Scan full history once and rotate anything found.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- .gitleaks.toml, .secrets.baseline or a trufflehog step in CI.
- A gitleaks or detect-secrets hook in .pre-commit-config.yaml.
Where the scanned repositories configure it:
.gitleaks.tomlin 3 repositories.pre-commit-config.yamlin 3 repositories.github/workflows/*.ymlin 2 repositories.husky/pre-commitin 1 repositories
Detected by the scanner as: Secret scanning (credentials and tokens committed to the repository.)
Open-source packages
3
- Gitleaks gitleaks/gitleaks
- TruffleHog trufflesecurity/trufflehog
- detect-secrets Yelp/detect-secrets
Tools seen in scans
by repositories that run them
| Tool | Repos | Command seen | Runs in | Docs |
|---|---|---|---|---|
gitleaks |
7 | gitleaks git --pre-commit --redact --staged --verbose |
pre-commit, ci | docs |
Procedure examples
repositories that run it, most-starred first
| Repository | Tools | Runs in | Evidence |
|---|---|---|---|
| cline/cline | gitleaks |
pre-commit | .husky/pre-commit line 8 |
| awslabs/mcp | gitleaks |
pre-commit, ci | .github/workflows/pre-commit.yml jobs.pre-commit.steps[5] |
| maximhq/bifrost | gitleaks |
pre-commit | .pre-commit-config.yaml hooks.gitleaks |
| snyk/cli | gitleaks |
pre-commit | .pre-commit-config.yaml hooks.gitleaks |
| awslabs/aidlc-workflows | gitleaks |
ci | .github/workflows/security-scanners.yml jobs.gitleaks.steps[1] (Install Gitle... |