Skip to content

Commit 5562d2f

Browse files
ctrl-alt-automatectrl-alt-automate
committed
security: add gitleaks scanning + 2026-04-18 security delta review
Delta review between PR #377 (2026-03-17) and 7b42e36 found no new critical/high issues. Three cybersecurity-skills toolkits ran: gitleaks secret scanning, GitHub Actions workflow hardening, and cryptographic audit of the delta. Historic leak surfaced: 4 real test-instance tokens (zwqg, plasma, zulu, badger) sat in public git history from late-2025 / early-2026. All four are now dead ('Invalid token' response), so the exposure is stale — but worth documenting and preventing recurrence. Adds: - .gitleaks.toml: custom rules for NetBox v1 (40-hex) and v2 (nbt_*) token formats plus a project-wide allowlist (docker-compose bootstrap token, Slack webhook placeholders, generic 'your-key' patterns) - .gitleaks-baseline.json: snapshot of 8 historic (dead-token) findings so CI only flags new secrets - .github/workflows/secret-scan.yml: gitleaks CI on every push/PR to dev/main via gitleaks-action@v2 - .pre-commit-config.yaml: opt-in local gitleaks pre-commit hook - docs/superpowers/reviews/2026-04-18-security-delta-review.md: full findings report with severity tags and follow-up PR list Medium findings documented for follow-up (not fixed here): - pre-release-validation.yml: 5 \${{ inputs.* }} interpolations into pwsh run-blocks (script injection vector via workflow_dispatch) - actions/* SHA pinning: 25+ unpinned references to GitHub-owned actions (supply-chain hardening) Positive findings worth preserving: - PR #377 HTTP-plaintext warning, SkipCertificateCheck opt-in, AllowInsecureRedirect warning are all intact - zwqg token was protected by NetBox per-token IP allowlist during its live window — a defense-in-depth layer that should be enabled on all prod-hosted tokens - Central auth + TLS code in InvokeNetboxRequest, Connect-NBAPI, Set-NBCipherSSL is unchanged since PR #377 (no regressions)
1 parent 7b42e36 commit 5562d2f

5 files changed

Lines changed: 572 additions & 0 deletions

File tree

‎.github/workflows/secret-scan.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Secret Scan
2+
3+
on:
4+
push:
5+
branches: [dev, main, master]
6+
pull_request:
7+
branches: [dev, main, master]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
gitleaks:
14+
name: Gitleaks
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v4
19+
with:
20+
fetch-depth: 0 # Full history — gitleaks needs commits to scan
21+
22+
- name: Run gitleaks
23+
uses: gitleaks/gitleaks-action@v2
24+
env:
25+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26+
# Gitleaks picks up .gitleaks.toml and .gitleaks-baseline.json
27+
# from the repo root automatically.
28+
GITLEAKS_ENABLE_SUMMARY: "true"
29+
GITLEAKS_ENABLE_COMMENTS: "true"

‎.gitleaks-baseline.json‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
[
2+
{
3+
"RuleID": "netbox-v2-token",
4+
"Description": "NetBox v2 Bearer token (nbt_\u003ckey\u003e.\u003csecret\u003e)",
5+
"StartLine": 272,
6+
"EndLine": 272,
7+
"StartColumn": 23,
8+
"EndColumn": 79,
9+
"Match": "nbt_kVJSfSxl3xvO.b4KIab8fc0sKntsws0KK7j6VwWNYnztZ9BOC7NAq",
10+
"Secret": "nbt_kVJSfSxl3xvO.b4KIab8fc0sKntsws0KK7j6VwWNYnztZ9BOC7NAq",
11+
"File": ".github/workflows/integration.yml",
12+
"SymlinkFile": "",
13+
"Commit": "8044791c23a49df78e385aca6ffc74b0023f8ab1",
14+
"Link": "https://github.com/ctrl-alt-automate/PowerNetbox/blob/8044791c23a49df78e385aca6ffc74b0023f8ab1/.github/workflows/integration.yml#L272",
15+
"Entropy": 5.043073,
16+
"Author": "ctrl-alt-automate",
17+
"Email": "elvis@deployment-team.nl",
18+
"Date": "2026-01-06T12:54:06Z",
19+
"Message": "security: Remove hardcoded tokens from ScenarioTestHelper\n\nBREAKING CHANGE: Test credentials now loaded from environment variables\n\nRequired environment variables:\n- NETBOX_449_HOST / NETBOX_449_TOKEN (plasma-paint)\n- NETBOX_449_ZWQG_HOST / NETBOX_449_ZWQG_TOKEN (cloud.netboxapp.com)\n- NETBOX_437_HOST / NETBOX_437_TOKEN (badger-victor)\n- NETBOX_450_HOST / NETBOX_450_TOKEN (zulu-how)\n\nAdded validation with clear error messages when env vars are missing.\n\nIMPORTANT: Revoke and regenerate all exposed tokens immediately!\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 \u003cnoreply@anthropic.com\u003e",
20+
"Tags": [
21+
"netbox",
22+
"token",
23+
"v2"
24+
],
25+
"Fingerprint": "8044791c23a49df78e385aca6ffc74b0023f8ab1:.github/workflows/integration.yml:netbox-v2-token:272"
26+
},
27+
{
28+
"RuleID": "generic-api-key",
29+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
30+
"StartLine": 13,
31+
"EndLine": 13,
32+
"StartColumn": 10,
33+
"EndColumn": 62,
34+
"Match": "Token = '4188039a3a05ebb58e4969873bace61c77222eb7'",
35+
"Secret": "4188039a3a05ebb58e4969873bace61c77222eb7",
36+
"File": "Tests/Scenario/ScenarioTestHelper.psm1",
37+
"SymlinkFile": "",
38+
"Commit": "02c3b9594f380b310bc07ea43487019d3d960e49",
39+
"Link": "https://github.com/ctrl-alt-automate/PowerNetbox/blob/02c3b9594f380b310bc07ea43487019d3d960e49/Tests/Scenario/ScenarioTestHelper.psm1#L13",
40+
"Entropy": 3.7464395,
41+
"Author": "ctrl-alt-automate",
42+
"Email": "elvis@deployment-team.nl",
43+
"Date": "2026-01-03T15:16:15Z",
44+
"Message": "feat: Add 500 error fallback for bulk operations\n\nWhen bulk API requests fail with 500 Internal Server Error (which can\noccur due to Redis cache inconsistency on cloud-hosted Netbox instances),\nthe module now automatically falls back to sequential single-item requests.\n\nChanges:\n- Send-NBBulkRequest: Add 500 error detection and sequential fallback\n with exponential backoff retry (3 attempts, 500ms/1s/2s delays)\n- Connect-NBAPI: Add AllowInsecureRedirect for PS 7.4+ compatibility\n- Set-NBIPAMAddress: Add ValueFromPipelineByPropertyName to Status/Description\n- Get-NBTenant: Rename GroupID to Group_Id with backwards-compatible alias\n- Add Scenario test suite for bulk operations, workflows, filters\n\nFixes: Test file bug where $($i++) in string interpolation doesn't work\nin PowerShell - increment must be on separate line before use.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 \u003cnoreply@anthropic.com\u003e",
45+
"Tags": [],
46+
"Fingerprint": "02c3b9594f380b310bc07ea43487019d3d960e49:Tests/Scenario/ScenarioTestHelper.psm1:generic-api-key:13"
47+
},
48+
{
49+
"RuleID": "generic-api-key",
50+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
51+
"StartLine": 18,
52+
"EndLine": 18,
53+
"StartColumn": 10,
54+
"EndColumn": 62,
55+
"Match": "Token = 'a9717b9520d54d19383649066ef3b25e313bf219'",
56+
"Secret": "a9717b9520d54d19383649066ef3b25e313bf219",
57+
"File": "Tests/Scenario/ScenarioTestHelper.psm1",
58+
"SymlinkFile": "",
59+
"Commit": "02c3b9594f380b310bc07ea43487019d3d960e49",
60+
"Link": "https://github.com/ctrl-alt-automate/PowerNetbox/blob/02c3b9594f380b310bc07ea43487019d3d960e49/Tests/Scenario/ScenarioTestHelper.psm1#L18",
61+
"Entropy": 3.7659574,
62+
"Author": "ctrl-alt-automate",
63+
"Email": "elvis@deployment-team.nl",
64+
"Date": "2026-01-03T15:16:15Z",
65+
"Message": "feat: Add 500 error fallback for bulk operations\n\nWhen bulk API requests fail with 500 Internal Server Error (which can\noccur due to Redis cache inconsistency on cloud-hosted Netbox instances),\nthe module now automatically falls back to sequential single-item requests.\n\nChanges:\n- Send-NBBulkRequest: Add 500 error detection and sequential fallback\n with exponential backoff retry (3 attempts, 500ms/1s/2s delays)\n- Connect-NBAPI: Add AllowInsecureRedirect for PS 7.4+ compatibility\n- Set-NBIPAMAddress: Add ValueFromPipelineByPropertyName to Status/Description\n- Get-NBTenant: Rename GroupID to Group_Id with backwards-compatible alias\n- Add Scenario test suite for bulk operations, workflows, filters\n\nFixes: Test file bug where $($i++) in string interpolation doesn't work\nin PowerShell - increment must be on separate line before use.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 \u003cnoreply@anthropic.com\u003e",
66+
"Tags": [],
67+
"Fingerprint": "02c3b9594f380b310bc07ea43487019d3d960e49:Tests/Scenario/ScenarioTestHelper.psm1:generic-api-key:18"
68+
},
69+
{
70+
"RuleID": "netbox-v2-token",
71+
"Description": "NetBox v2 Bearer token (nbt_\u003ckey\u003e.\u003csecret\u003e)",
72+
"StartLine": 28,
73+
"EndLine": 28,
74+
"StartColumn": 22,
75+
"EndColumn": 78,
76+
"Match": "nbt_kVJSfSxl3xvO.b4KIab8fc0sKntsws0KK7j6VwWNYnztZ9BOC7NAq",
77+
"Secret": "nbt_kVJSfSxl3xvO.b4KIab8fc0sKntsws0KK7j6VwWNYnztZ9BOC7NAq",
78+
"File": "Tests/Scenario/ScenarioTestHelper.psm1",
79+
"SymlinkFile": "",
80+
"Commit": "02c3b9594f380b310bc07ea43487019d3d960e49",
81+
"Link": "https://github.com/ctrl-alt-automate/PowerNetbox/blob/02c3b9594f380b310bc07ea43487019d3d960e49/Tests/Scenario/ScenarioTestHelper.psm1#L28",
82+
"Entropy": 5.043073,
83+
"Author": "ctrl-alt-automate",
84+
"Email": "elvis@deployment-team.nl",
85+
"Date": "2026-01-03T15:16:15Z",
86+
"Message": "feat: Add 500 error fallback for bulk operations\n\nWhen bulk API requests fail with 500 Internal Server Error (which can\noccur due to Redis cache inconsistency on cloud-hosted Netbox instances),\nthe module now automatically falls back to sequential single-item requests.\n\nChanges:\n- Send-NBBulkRequest: Add 500 error detection and sequential fallback\n with exponential backoff retry (3 attempts, 500ms/1s/2s delays)\n- Connect-NBAPI: Add AllowInsecureRedirect for PS 7.4+ compatibility\n- Set-NBIPAMAddress: Add ValueFromPipelineByPropertyName to Status/Description\n- Get-NBTenant: Rename GroupID to Group_Id with backwards-compatible alias\n- Add Scenario test suite for bulk operations, workflows, filters\n\nFixes: Test file bug where $($i++) in string interpolation doesn't work\nin PowerShell - increment must be on separate line before use.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 \u003cnoreply@anthropic.com\u003e",
87+
"Tags": [
88+
"netbox",
89+
"token",
90+
"v2"
91+
],
92+
"Fingerprint": "02c3b9594f380b310bc07ea43487019d3d960e49:Tests/Scenario/ScenarioTestHelper.psm1:netbox-v2-token:28"
93+
},
94+
{
95+
"RuleID": "netbox-v2-token",
96+
"Description": "NetBox v2 Bearer token (nbt_\u003ckey\u003e.\u003csecret\u003e)",
97+
"StartLine": 242,
98+
"EndLine": 242,
99+
"StartColumn": 24,
100+
"EndColumn": 80,
101+
"Match": "nbt_kVJSfSxl3xvO.b4KIab8fc0sKntsws0KK7j6VwWNYnztZ9BOC7NAq",
102+
"Secret": "nbt_kVJSfSxl3xvO.b4KIab8fc0sKntsws0KK7j6VwWNYnztZ9BOC7NAq",
103+
"File": ".github/workflows/integration.yml",
104+
"SymlinkFile": "",
105+
"Commit": "a449cfaa9c6c7618986285ab852df27a9e863c0b",
106+
"Link": "https://github.com/ctrl-alt-automate/PowerNetbox/blob/a449cfaa9c6c7618986285ab852df27a9e863c0b/.github/workflows/integration.yml#L242",
107+
"Entropy": 5.043073,
108+
"Author": "ctrl-alt-automate",
109+
"Email": "elvis@deployment-team.nl",
110+
"Date": "2025-12-30T09:13:28Z",
111+
"Message": "ci: Add exe.dev live testing workflow and v2 token support\n\n- Update version matrix: 4.3.7, 4.4.9, 4.5.0-beta1\n- Add v2 token tests for Netbox 4.5+ in integration.yml\n- Add 4.5.0-beta1 to compatibility.yml\n- Create exe-dev-tests.yml for testing against live exe.dev VMs\n - Manual trigger with VM selection (all/stable/minimum/beta)\n - Quick and full test scopes\n - Requires EXEDEV_TOKEN_* secrets\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 \u003cnoreply@anthropic.com\u003e",
112+
"Tags": [
113+
"netbox",
114+
"token",
115+
"v2"
116+
],
117+
"Fingerprint": "a449cfaa9c6c7618986285ab852df27a9e863c0b:.github/workflows/integration.yml:netbox-v2-token:242"
118+
},
119+
{
120+
"RuleID": "generic-api-key",
121+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
122+
"StartLine": 12,
123+
"EndLine": 12,
124+
"StartColumn": 2,
125+
"EndColumn": 49,
126+
"Match": "TOKEN=\"a9717b9520d54d19383649066ef3b25e313bf219\"",
127+
"Secret": "a9717b9520d54d19383649066ef3b25e313bf219",
128+
"File": ".claude/commands/implement.md",
129+
"SymlinkFile": "",
130+
"Commit": "ef1726d42f622dedf4579016dd6a4fa13df26f17",
131+
"Link": "https://github.com/ctrl-alt-automate/PowerNetbox/blob/ef1726d42f622dedf4579016dd6a4fa13df26f17/.claude/commands/implement.md?plain=1#L12",
132+
"Entropy": 3.7659574,
133+
"Author": "ctrl-alt-automate",
134+
"Email": "elvis@deployment-team.nl",
135+
"Date": "2025-12-10T22:15:53Z",
136+
"Message": "Add development tooling and Claude Code integration\n\n- Add CLAUDE.md with project overview and development guide\n- Add Connect-DevNetbox.ps1 helper script for quick API connection\n- Add .netboxps.config.example.ps1 template for local credentials\n- Add specialized slash commands for AI-assisted development:\n - /netbox-api: Netbox API expert for endpoint documentation\n - /powershell-expert: PowerShell best practices guidance\n - /implement: Combined workflow for new endpoint implementation\n - /test-endpoint: Compatibility testing against Netbox 4.4.7\n- Update .gitignore to exclude local config files\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 \u003cnoreply@anthropic.com\u003e",
137+
"Tags": [],
138+
"Fingerprint": "ef1726d42f622dedf4579016dd6a4fa13df26f17:.claude/commands/implement.md:generic-api-key:12"
139+
},
140+
{
141+
"RuleID": "generic-api-key",
142+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
143+
"StartLine": 8,
144+
"EndLine": 8,
145+
"StartColumn": 2,
146+
"EndColumn": 49,
147+
"Match": "TOKEN=\"a9717b9520d54d19383649066ef3b25e313bf219\"",
148+
"Secret": "a9717b9520d54d19383649066ef3b25e313bf219",
149+
"File": ".claude/commands/test-endpoint.md",
150+
"SymlinkFile": "",
151+
"Commit": "ef1726d42f622dedf4579016dd6a4fa13df26f17",
152+
"Link": "https://github.com/ctrl-alt-automate/PowerNetbox/blob/ef1726d42f622dedf4579016dd6a4fa13df26f17/.claude/commands/test-endpoint.md?plain=1#L8",
153+
"Entropy": 3.7659574,
154+
"Author": "ctrl-alt-automate",
155+
"Email": "elvis@deployment-team.nl",
156+
"Date": "2025-12-10T22:15:53Z",
157+
"Message": "Add development tooling and Claude Code integration\n\n- Add CLAUDE.md with project overview and development guide\n- Add Connect-DevNetbox.ps1 helper script for quick API connection\n- Add .netboxps.config.example.ps1 template for local credentials\n- Add specialized slash commands for AI-assisted development:\n - /netbox-api: Netbox API expert for endpoint documentation\n - /powershell-expert: PowerShell best practices guidance\n - /implement: Combined workflow for new endpoint implementation\n - /test-endpoint: Compatibility testing against Netbox 4.4.7\n- Update .gitignore to exclude local config files\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 \u003cnoreply@anthropic.com\u003e",
158+
"Tags": [],
159+
"Fingerprint": "ef1726d42f622dedf4579016dd6a4fa13df26f17:.claude/commands/test-endpoint.md:generic-api-key:8"
160+
},
161+
{
162+
"RuleID": "generic-api-key",
163+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
164+
"StartLine": 21,
165+
"EndLine": 21,
166+
"StartColumn": 2,
167+
"EndColumn": 49,
168+
"Match": "TOKEN=\"a9717b9520d54d19383649066ef3b25e313bf219\"",
169+
"Secret": "a9717b9520d54d19383649066ef3b25e313bf219",
170+
"File": ".claude/commands/netbox-api.md",
171+
"SymlinkFile": "",
172+
"Commit": "ef1726d42f622dedf4579016dd6a4fa13df26f17",
173+
"Link": "https://github.com/ctrl-alt-automate/PowerNetbox/blob/ef1726d42f622dedf4579016dd6a4fa13df26f17/.claude/commands/netbox-api.md?plain=1#L21",
174+
"Entropy": 3.7659574,
175+
"Author": "ctrl-alt-automate",
176+
"Email": "elvis@deployment-team.nl",
177+
"Date": "2025-12-10T22:15:53Z",
178+
"Message": "Add development tooling and Claude Code integration\n\n- Add CLAUDE.md with project overview and development guide\n- Add Connect-DevNetbox.ps1 helper script for quick API connection\n- Add .netboxps.config.example.ps1 template for local credentials\n- Add specialized slash commands for AI-assisted development:\n - /netbox-api: Netbox API expert for endpoint documentation\n - /powershell-expert: PowerShell best practices guidance\n - /implement: Combined workflow for new endpoint implementation\n - /test-endpoint: Compatibility testing against Netbox 4.4.7\n- Update .gitignore to exclude local config files\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 \u003cnoreply@anthropic.com\u003e",
179+
"Tags": [],
180+
"Fingerprint": "ef1726d42f622dedf4579016dd6a4fa13df26f17:.claude/commands/netbox-api.md:generic-api-key:21"
181+
}
182+
]

‎.gitleaks.toml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# PowerNetbox Gitleaks Configuration
2+
# Extends the default rule set with PowerNetbox-specific patterns
3+
# and an allowlist for known test/placeholder values.
4+
5+
title = "PowerNetbox Gitleaks Configuration"
6+
7+
[extend]
8+
useDefault = true
9+
10+
# Custom rule: NetBox v2 Bearer token format (nbt_<key>.<secret>)
11+
[[rules]]
12+
id = "netbox-v2-token"
13+
description = "NetBox v2 Bearer token (nbt_<key>.<secret>)"
14+
regex = '''nbt_[A-Za-z0-9]{10,}\.[A-Za-z0-9]{30,}'''
15+
keywords = ["nbt_"]
16+
tags = ["netbox", "token", "v2"]
17+
18+
[rules.allowlist]
19+
description = "Placeholder v2 tokens used in docs and tests"
20+
regexTarget = "match"
21+
regexes = [
22+
'''nbt_abc123\.xyz789''',
23+
'''nbt_ExampleKey123\.ExampleSecretValue456789''',
24+
'''nbt_yourKey\.yourSecret''',
25+
'''nbt_\{key\}\.\{secret\}''',
26+
]
27+
28+
# Custom rule: NetBox v1 token (40-char hex)
29+
[[rules]]
30+
id = "netbox-v1-token"
31+
description = "NetBox v1 API token (40-char hex key)"
32+
regex = '''(?i)(?:netbox[_-]?token|nb[_-]?token|api[_-]?token)\s*[:=]\s*["']?([a-f0-9]{40})["']?'''
33+
keywords = ["token", "netbox"]
34+
tags = ["netbox", "token", "v1"]
35+
36+
# Global allowlist for common PowerNetbox test/placeholder values
37+
[allowlist]
38+
description = "PowerNetbox project-wide allowlist"
39+
40+
paths = [
41+
# Tests use fake tokens throughout
42+
'''(^|/)Tests/.*\.Tests\.ps1$''',
43+
# Docs reference example tokens
44+
'''(^|/)docs/''',
45+
# This file itself
46+
'''(^|/)\.gitleaks\.toml$''',
47+
# Baseline captures historic findings that have been rotated
48+
'''(^|/)\.gitleaks-baseline\.json$''',
49+
]
50+
51+
regexes = [
52+
# docker-compose.ci.yml bootstrap token (public netbox-docker default)
53+
'''0123456789abcdef0123456789abcdef01234567''',
54+
# Slack webhook placeholder pattern (T00000000/B00000000/XXX...)
55+
'''hooks\.slack\.com/services/T0+/B0+/X+''',
56+
# Common placeholder patterns
57+
'''(?i)your[-_]?(api[-_]?)?(token|key|secret)''',
58+
'''(?i)(example|sample|placeholder|fake|dummy|test)[-_]?(token|key|secret)''',
59+
'''(?i)(<|\[|\{)[^>\]\}]*(token|key|secret|password)[^>\]\}]*(>|\]|\})''',
60+
# xxxxxxxx, ****, 00000000 sequences
61+
'''x{8,}''',
62+
'''\*{8,}''',
63+
'''0{10,}''',
64+
]

‎.pre-commit-config.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Pre-commit hooks for PowerNetbox
2+
#
3+
# Install: pip install pre-commit && pre-commit install
4+
# Run all: pre-commit run --all-files
5+
#
6+
# Gitleaks prevents secrets from landing in commits in the first place.
7+
# Configuration and baseline live in .gitleaks.toml / .gitleaks-baseline.json.
8+
9+
repos:
10+
- repo: https://github.com/gitleaks/gitleaks
11+
rev: v8.30.1
12+
hooks:
13+
- id: gitleaks
14+
name: Detect hardcoded secrets
15+
description: Block commits containing hardcoded secrets (uses .gitleaks.toml)

0 commit comments

Comments
 (0)
⚡