Skip to content

Verification · Static analysis · Secret scanning

History scan

Scan full git history, since deleting a secret in a later commit does not remove it.

How to build it

Run the scanner once over the full git history.
Rotate every credential found, even if a later commit removed it.
Re-run the history scan on a schedule, not only on pull requests.

Signals in a repository

A scheduled CI workflow that scans full history with gitleaks or trufflehog.
Allow-list entries that name a reviewed historic commit hash.
A rotation record or incident note for each historic finding.

In practice

7 repositories run a tool for this check in the scanned set.

gitleaks · 7 repos

Examples

cline/cline · gitleaks

gitleaks git --pre-commit --redact --staged --verbose

awslabs/mcp · gitleaks
```
pre-commit hook gitleaks
```
maximhq/bifrost · gitleaks
```
pre-commit hook gitleaks
```
snyk/cli · gitleaks
```
pre-commit hook gitleaks
```
awslabs/aidlc-workflows · gitleaks
```
gitleaks version
```