Secret-scan classification for CI
One number for your secret scan
gitleaks and trufflehog flag every key-shaped string, including publishable keys and documented placeholders. secret-scan sorts each finding into one verdict, so your gate fails only when .summary.private is above zero.
- private: real secret shape, fails the gate0
- public: safe by design, counted not listed12
- triage: listed for a human, does not fail1
- rawGitleaksMatches: before classification14
- allowlistedFindings: line-bound exceptions1
gate: .summary.private == 0, pass
What it does
- 01
Three verdicts, one gate
Every finding gets exactly one verdict:
private,publicortriage. Onlyprivatefails the gate. - 02
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
- 03
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.
- 04
Reviewed exceptions
Two kinds of hand-reviewed rule stop known-safe findings: whole-file exceptions and line-bound exceptions.
- 05
Fail toward reporting
Any doubt in the suppression path reports the finding instead of suppressing it.
- 06
Trufflehog-verified is always private
When trufflehog confirmed a credential with its provider, the finding is
privatewhatever the classifier says.
From scan to gate
- Step 1
Generate the config
generate-gitleaks-config.mjswritesgenerated.gitleaks.tomlbeside the script, built from the private value rules and the whole-file exceptions. It is never committed. - Step 2
Scan
gitleaks scans the repository with that config and writes a JSON report. trufflehog is optional and writes NDJSON.
- Step 3
Filter
Run
filter-gitleaks-output.mjs <report.json>with the cwd at the scanned repository root andgiton PATH, or pipe trufflehog output intofilter-trufflehog-output.mjs. - Step 4
Gate
Fail the job when
.summary.privateis above zero.triagefindings are listed for a human but do not fail it.
Put one clear gate behind your scanner
Four zero-dependency Node modules that run in your CI job. Nothing calls a service and there is no account.