Hardcoded secret detection and prevention in git repositories and codebases using Gitleaks. Identifies passwords, API keys, tokens, and credentials through regex-based pattern matching and entropy analysis. Use when: (1) Scanning repositories for exposed secrets and credentials, (2) Implementing pre-commit hooks to prevent secret leakage, (3) Integrating secret detection into CI/CD pipelines, (4) Auditing codebases for compliance violations (PCI-DSS, SOC2, GDPR), (5) Establishing baseline secret detection and tracking new exposures, (6) Remediating historical secret exposures in git history.
Hardcoded secret detection and prevention in git repositories and codebases using Gitleaks. Identifies passwords, API keys, tokens, and credentials through regex-based pattern matching and entropy analysis. Use when: (1) Scanning repositories for exposed secrets and credentials, (2) Implementing pre-commit hooks to prevent secret leakage, (3) Integrating secret detection into CI/CD pipelines, (4) Auditing codebases for compliance violations (PCI-DSS, SOC2, GDPR), (5) Establishing baseline secret detection and tracking new exposures, (6) Remediating historical secret exposures in git history.
Gitleaks is a secret detection tool that scans git repositories, files, and directories for hardcoded credentials including passwords, API keys, tokens, and other sensitive information. It uses regex-based pattern matching combined with Shannon entropy analysis to identify secrets that could lead to unauthorized access if exposed.
This skill provides comprehensive guidance for integrating Gitleaks into DevSecOps workflows, from pre-commit hooks to CI/CD pipelines, with emphasis on preventing secret leakage before code reaches production.
gitlab-ci.yml - Complete GitLab CI pipeline template
Common Patterns
Pattern 1: Initial Repository Audit
First-time secret scanning for security assessment:
# 1. Clone repository with full history
git clone --mirror https://github.com/org/repo.git audit-repo
cd audit-repo
# 2. Run comprehensive scan
gitleaks detect --report-path audit-report.json --report-format json -v
# 3. Generate human-readable report
./scripts/scan_and_report.py --input audit-report.json --format markdown --output audit-report.md
# 4. Review findings and classify false positives# Edit .gitleaks.toml to add allowlist entries# 5. Create baseline for future scanscp audit-report.json baseline.json
Pattern 2: Developer Workstation Setup
Protect developers from accidental secret commits:
# 1. Install gitleaks locally
brew install gitleaks # macOS# or use package manager for your OS# 2. Install pre-commit hook
./scripts/install_precommit.sh
# 3. Test hook with dummy commitecho"api_key = 'EXAMPLE_KEY_12345'" > test.txt
git add test.txt
git commit -m "test"# Should be blocked by gitleaks# 4. Clean up test
git reset HEAD~1
rm test.txt
Pattern 3: CI/CD Pipeline with Baseline
Progressive secret detection in continuous integration:
# In CI pipeline script:# 1. Check if baseline existsif [ -f ".gitleaks-baseline.json" ]; then# Incremental scan - only new secrets
gitleaks detect \
--baseline-path .gitleaks-baseline.json \
--report-path new-findings.json \
--report-format json \
--exit-code 1 # Fail on new secretselse# Initial scan - create baseline
gitleaks detect \
--report-path .gitleaks-baseline.json \
--report-format json \
--exit-code 0 # Don't fail on first scanfi# 2. Generate SARIF for GitHub Security tabif [ -f "new-findings.json" ] && [ -s "new-findings.json" ]; then
gitleaks detect \
--baseline-path .gitleaks-baseline.json \
--report-path results.sarif \
--report-format sarif
fi
For secrets without clear patterns, use Shannon entropy analysis:
[[rules]]id = "high-entropy-strings"description = "High entropy strings that may be secrets"regex = '''[a-zA-Z0-9]{32,}'''entropy = 4.5# Shannon entropy thresholdsecretGroup = 0
Composite Rules (v8.28.0+)
Detect secrets spanning multiple lines or requiring context:
[[rules]]id = "multi-line-secret"description = "API key with usage context"regex = '''api_key[\s]*='''[[rules.composite]]pattern = '''initialize_client'''location = "line"# Must be within same line proximitydistance = 5# Within 5 lines
Global vs Rule-Specific Allowlists
# Global allowlist (highest precedence)[allowlist]description = "Organization-wide exceptions"paths = ['''vendor/''', '''node_modules/''']
# Rule-specific allowlist[[rules]]id = "generic-api-key"[rules.allowlist]description = "Exceptions only for this rule"regexes = ['''key\s*=\s*EXAMPLE''']
