Skip to content

Verification · Static analysis · Secret scanning

Pre-commit secret scan

Block the commit locally, before the secret reaches a remote.

How to build it

Add the gitleaks or detect-secrets hook to .pre-commit-config.yaml.
Commit the scanner config that holds the allow-list rules.
Run the same scanner and config in CI so local and remote results match.

Signals in a repository

A gitleaks or detect-secrets hook id in .pre-commit-config.yaml.
A .gitleaks.toml or .secrets.baseline file at the repository root.
A CI job that runs gitleaks with the repository config.

In practice

7 repositories run a tool for this check in the scanned set.

gitleaks · 7 repos

Examples

cline/cline · gitleaks

gitleaks git --pre-commit --redact --staged --verbose

awslabs/mcp · gitleaks
```
pre-commit hook gitleaks
```
maximhq/bifrost · gitleaks
```
pre-commit hook gitleaks
```
snyk/cli · gitleaks
```
pre-commit hook gitleaks
```
awslabs/aidlc-workflows · gitleaks
```
gitleaks version
```