Automated secret scanning for every managed repository

Every managed repository now has an automated secret scan in its CI. A pull request or push that would commit a credential (AWS key, API token, password, private key, …) is blocked before it can merge, and our security team is alerted automatically.

A secret committed to git is not gone when the file is deleted: it stays readable in the repository’s history for years. The only real fix after the fact is rotating the credential.

How it’s implemented

• A new secret-scan.yml workflow runs on every pull request and push. It scans only new commits, so it never flags pre-existing history.
• We ran a full scan of each repository’s history and reviewed every finding. The reviewed backlog is stored in a .gitleaksignore file in your repository, so the scanner won’t flag known (rotated) findings and only reports new ones.
• This check is required: a pull request that introduces a secret cannot merge until the secret is removed.

Secret values never appear in logs or alerts; findings are redacted.

Action when a secret is detected

The scanner points at the file and line. Remove the secret from your change, and rotate it. Secrets that belong in the repository should be encrypted (SOPS/KMS) or belong in a secret store, not in git. If you think a finding is a false positive, get in touch and we’ll review it.