testland/gitleaks-scanning
Use when a team needs open-source secret scanning on commits and in CI, or is adopting it on a repo with existing leaks: gitleaks git, dir and stdin scans, custom rules and allowlists in .gitleaks.toml, pre-commit and GitHub Action setup, baselines, and TruffleHog live verification.
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
custom-rules-and-triage.mdreferences/
gitleaks custom rules and false-positive triage
Custom org-internal rules and the mandatory allowlist / baseline / justification workflow. Referenced from Step 4 and Step 5 of the gitleaks-scanning skill.
Custom rule example
# .gitleaks.toml
[extend]
useDefault = true
[[rules]]
id = "internal-api-key"
description = "Internal API key (acme- prefix)"
regex = '''(?i)acme[_-]?api[_-]?key[_-]?[a-zA-Z0-9]{32}'''
secretGroup = 1
keywords = ["acme"]
tags = ["acme-internal"]
[[rules.allowlists]]
description = "Test fixtures"
paths = ['''tests/fixtures/.*\.json$''']
[[allowlists]]
description = "Project-wide allowlist (legacy commits)"
commits = ["abc1234", "def5678"]
paths = ['''vendor/.*''', '''third_party/.*''']The [extend] useDefault = true keeps built-in rules; without it,
your custom rules replace the defaults entirely.
False-positive triage (MANDATORY)
Suppression mechanisms in priority order:
| Mechanism | Where | When to use |
|---|---|---|
[[rules.allowlists]] paths | .gitleaks.toml | Per-rule path exclusion (test fixtures, vendor) |
[[rules.allowlists]] commits | .gitleaks.toml | Per-rule commit exclusion (historical false positive) |
[[allowlists]] paths | .gitleaks.toml (top-level) | All-rule path exclusion |
--baseline-path | CI flag | Legacy debt: only fail on NEW findings vs baseline |
Inline # gitleaks:allow comment | Code | Single-line suppression |
Baseline workflow (per gl-gh):
# Create baseline
gitleaks git --report-path gitleaks-baseline.json
# Apply baseline (only new findings fail)
gitleaks git --baseline-path gitleaks-baseline.json --report-path findings.jsonJustification template (mandatory in .gitleaks.toml):
[[rules.allowlists]]
description = """
Reason: tests/fixtures/* contains intentional dummy AWS credentials
for SDK initialization tests; never used against real AWS.
Approved-by: alice@example.com
Re-review-date: 2026-09-15 (re-evaluate when SDK supports mock-mode injection)
"""
paths = ['''tests/fixtures/.*\.json$''']Cadence: every quarter, audit .gitleaks.toml allowlist entries;
expired re-review-date entries removed.