Configure gitleaks and trufflehog for secret scanning with pre-receive and pre-commit hooks
domain: github.com/gitleaks/gitleaks · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Install gitleaks and configure a rules file that covers your organization's secret patterns (API keys, tokens, certificates)
Add a pre-commit hook that runs gitleaks detect on staged changes before allowing a commit to proceed
Configure trufflehog to scan the full git history of a repository to identify previously committed secrets
Set up a server-side pre-receive hook (or a CI check on every push) to block pushes containing detected secrets
Establish a process for rotating and revoking any secrets that are found, and document findings in an incident log
Tune both tools' allow-list configurations to suppress known false positives while preserving detection fidelity
Known gotchas
Pre-commit hooks only run in environments where the hook is installed; contributors who bypass hooks or use git directly without hook setup will not be checked — server-side enforcement is essential
Regex-based secret detection produces false positives on test fixtures and example files; an overly broad allow-list created to suppress these can also suppress real secrets
Rotating a leaked secret is necessary but not sufficient; the original secret may be cached by external services or have been used for unauthorized access before detection
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?