secret-detection

Skill: Secret Detection

Expertise: trufflehog, gitleaks, git-secrets, pre-commit hooks, CI scanning, secret rotation playbook.

When to load

When setting up secret scanning pre-commit or in CI, investigating a potential credential leak, or remediating secrets found in git history.

Pre-Commit Hook Setup

# Install pre-commit
pip install pre-commit

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/trufflesecurity/trufflehog
    rev: v3.88.0
    hooks:
      - id: trufflehog
        name: TruffleHog — secret scan
        entry: trufflehog git file://. --since-commit HEAD --only-verified --fail
        language: system
        pass_filenames: false

  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.0
    hooks:
      - id: gitleaks
        name: Gitleaks — detect hardcoded secrets

# Install hooks for all team members (add to onboarding docs)
pre-commit install
pre-commit install --hook-type commit-msg

# Run against all files (one-time audit)
pre-commit run trufflehog --all-files
pre-commit run gitleaks --all-files

CI: trufflehog (GitHub Actions)

- name: Scan for secrets (trufflehog)
  uses: trufflesecurity/trufflehog@main
  with:
    path: ./
    base: ${{ github.event.repository.default_branch }}
    head: HEAD
    extra_args: >
      --only-verified
      --fail
      --format json
      --json-output trufflehog-results.json
  continue-on-error: false    # hard fail

- name: Upload results
  if: failure()
  uses: actions/upload-artifact@v4
  with:
    name: secret-scan-results
    path: trufflehog-results.json

CI: gitleaks (GitLab CI)

secret-scan:
  stage: validate
  image: zricethezav/gitleaks:latest
  script:
    - gitleaks detect
        --source .
        --config .gitleaks.toml
        --redact
        --exit-code 1
        --report-format json
        --report-path gitleaks-report.json
  artifacts:
    when: on_failure
    paths: [gitleaks-report.json]

gitleaks Configuration (.gitleaks.toml)