Awesome Reviewers

Verification · Static analysis

Secret scanning

Finds credentials and tokens in the working tree and in history before they are pushed or published.

Sub-techniques

  • Pre-commit secret scan V1008.001

    Block the commit locally, before the secret reaches a remote.

  • History scan V1008.002

    Scan full git history, since deleting a secret in a later commit does not remove it.

  • Live verification V1008.003

    Test whether a found credential is still valid to prioritise rotation.

How to build it

  1. Add a pre-commit hook and a CI job running the same scanner and config.
  2. Keep a baseline or allow-list for test fixtures, reviewed like code.
  3. Scan full history once and rotate anything found.

Signals in a repository

  • .gitleaks.toml, .secrets.baseline or a trufflehog step in CI.
  • A gitleaks or detect-secrets hook in .pre-commit-config.yaml.