[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFCH9N2EVSEA02KTSC61NB":3,"skill-same:01M6AFCH9N2EVSEA02KTSC61NB":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AFCH9N2EVSEA02KTSC61NB","implementing-secret-scanning-with-gitleaks",null,"This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI\u002FCD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"implementing secret scanning with gitleaks","gitleaks","secret scanning","remediation","pre-commit","secret-scanning","baseline","cicd","t1195","t1059","t1003","devsecops","pipeline","ci","git","pr","secure","commit","workflows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-secret-scanning-with-gitleaks\ndescription: 'This skill covers implementing Gitleaks for detecting and preventing\n  hardcoded secrets in git repositories. It addresses configuring pre-commit hooks,\n  CI\u002FCD pipeline integration, custom rule authoring for organization-specific secrets,\n  baseline management for existing repositories, and remediation workflows for exposed\n  credentials.\n\n  '\ndomain: cybersecurity\nsubdomain: devsecops\ntags:\n- devsecops\n- cicd\n- secret-scanning\n- gitleaks\n- pre-commit\n- secure-sdlc\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- GV.SC-07\n- ID.IM-04\n- PR.PS-04\nmitre_attack:\n- T1195\n- T1554\n- T1059.004\n- T1003\n- T1110\n---\n\n# Implementing Secret Scanning with Gitleaks\n\n## When to Use\n\n- When developers may accidentally commit API keys, passwords, tokens, or private keys to repositories\n- When establishing pre-commit gates that prevent secrets from entering the git history\n- When scanning existing repository history for previously committed secrets that need rotation\n- When compliance requirements mandate secret detection across all source code repositories\n- When migrating from manual secret audits to automated continuous scanning\n\n**Do not use** for detecting secrets in running applications or memory (use runtime secret detection), for managing secrets after detection (use Vault or AWS Secrets Manager), or for scanning container images (use Trivy or Grype).\n\n## Prerequisites\n\n- Gitleaks v8.18+ installed via binary, Go install, or Docker\n- Pre-commit framework installed for local hook integration\n- Git repository with history to scan\n- CI\u002FCD platform access (GitHub Actions, GitLab CI, or equivalent)\n\n## Workflow\n\n### Step 1: Install and Run Initial Repository Scan\n\nPerform a baseline scan of the repository to identify all existing secrets in the git history.\n\n```bash\n# Install Gitleaks\nbrew install gitleaks  # macOS\n# or download binary from https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\u002Freleases\n\n# Scan entire git history for secrets\ngitleaks detect --source . --report-format json --report-path gitleaks-report.json -v\n\n# Scan only staged changes (for pre-commit)\ngitleaks protect --staged --report-format json --report-path gitleaks-staged.json\n\n# Scan specific commit range\ngitleaks detect --source . --log-opts=\"HEAD~10..HEAD\" --report-format json\n\n# Scan without git history (filesystem only)\ngitleaks detect --source . --no-git --report-format json\n```\n\n### Step 2: Configure Pre-Commit Hook\n\nSet up Gitleaks as a pre-commit hook to prevent secrets from being committed.\n\n```yaml\n# .pre-commit-config.yaml\nrepos:\n  - repo: https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\n    rev: v8.21.2\n    hooks:\n      - id: gitleaks\n        name: gitleaks\n        description: Detect hardcoded secrets using Gitleaks\n        entry: gitleaks protect --staged --verbose --redact\n        language: golang\n        pass_filenames: false\n```\n\n```bash\n# Install pre-commit framework\npip install pre-commit\n\n# Install hooks defined in .pre-commit-config.yaml\npre-commit install\n\n# Run against all files (not just staged)\npre-commit run gitleaks --all-files\n\n# Test the hook with a deliberate secret\necho 'AWS_SECRET_ACCESS_KEY=\"wJalrXUtnFEMI\u002FK7MDENG\u002FbPxRfiCYEXAMPLEKEY\"' >> test.txt\ngit add test.txt\ngit commit -m \"test\"  # Should be blocked by gitleaks\n```\n\n### Step 3: Integrate into GitHub Actions\n\n```yaml\n# .github\u002Fworkflows\u002Fsecret-scanning.yml\nname: Secret Scanning\n\non:\n  push:\n    branches: [main, develop]\n  pull_request:\n    branches: [main]\n\njobs:\n  gitleaks:\n    name: Gitleaks Secret Scan\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0  # Full history for comprehensive scanning\n\n      - name: Run Gitleaks\n        uses: gitleaks\u002Fgitleaks-action@v2\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}  # Required for gitleaks-action v2\n\n      # Alternative: Run Gitleaks directly\n      - name: Install Gitleaks\n        run: |\n          wget -q https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\u002Freleases\u002Fdownload\u002Fv8.21.2\u002Fgitleaks_8.21.2_linux_x64.tar.gz\n          tar -xzf gitleaks_8.21.2_linux_x64.tar.gz\n          chmod +x gitleaks\n\n      - name: Scan for secrets\n        run: |\n          if [ \"${{ github.event_name }}\" == \"pull_request\" ]; then\n            .\u002Fgitleaks detect \\\n              --source . \\\n              --log-opts=\"${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\" \\\n              --report-format sarif \\\n              --report-path gitleaks.sarif \\\n              --exit-code 1\n          else\n            .\u002Fgitleaks detect \\\n              --source . \\\n              --report-format sarif \\\n              --report-path gitleaks.sarif \\\n              --exit-code 1 \\\n              --baseline-path .gitleaks-baseline.json\n          fi\n\n      - name: Upload SARIF\n        if: always()\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: gitleaks.sarif\n          category: gitleaks\n```\n\n### Step 4: Author Custom Detection Rules\n\nCreate organization-specific rules for internal secret patterns.\n\n```toml\n# .gitleaks.toml\ntitle = \"Organization Gitleaks Configuration\"\n\n[extend]\nuseDefault = true  # Include all default rules\n\n# Custom rule for internal API tokens\n[[rules]]\nid = \"internal-api-token\"\ndescription = \"Internal API token for service-to-service auth\"\nregex = '''(?i)x-internal-token[\"\\s:=]+[\"\\']?([a-zA-Z0-9_\\-]{40,})[\"\\']?'''\nentropy = 3.5\nkeywords = [\"x-internal-token\"]\ntags = [\"internal\", \"api\"]\n\n[[rules]]\nid = \"database-connection-string\"\ndescription = \"Database connection string with embedded credentials\"\nregex = '''(?i)(postgres|mysql|mongodb|redis):\u002F\u002F[^:]+:[^@]+@[^\u002F]+\u002F\\w+'''\nkeywords = [\"postgres:\u002F\u002F\", \"mysql:\u002F\u002F\", \"mongodb:\u002F\u002F\", \"redis:\u002F\u002F\"]\ntags = [\"database\", \"credentials\"]\n\n[[rules]]\nid = \"jwt-secret\"\ndescription = \"JWT signing secret\"\nregex = '''(?i)(jwt[_-]?secret|jwt[_-]?key)[\"\\s:=]+[\"\\']?([a-zA-Z0-9\u002F+_\\-]{32,})[\"\\']?'''\nentropy = 3.0\nkeywords = [\"jwt_secret\", \"jwt-secret\", \"jwt_key\", \"jwt-key\"]\n\n# Allowlist for test files and known safe patterns\n[allowlist]\ndescription = \"Global allowlist\"\npaths = [\n  '''(^|\u002F)test(s)?\u002F''',\n  '''(^|\u002F)spec\u002F''',\n  '''\\.test\\.(js|ts|py)$''',\n  '''\\.spec\\.(js|ts|py)$''',\n  '''__mocks__\u002F''',\n  '''fixtures\u002F''',\n  '''(^|\u002F)vendor\u002F''',\n  '''node_modules\u002F'''\n]\nregexes = [\n  '''EXAMPLE''',\n  '''example\\.com''',\n  '''test[-_]?(key|secret|token|password)''',\n  '''(?i)placeholder''',\n  '''000000+'''\n]\n```\n\n### Step 5: Manage Baselines for Existing Repositories\n\nCreate a baseline of known findings to avoid blocking development while historical secrets are being rotated.\n\n```bash\n# Generate baseline from current state\ngitleaks detect --source . --report-format json --report-path .gitleaks-baseline.json\n\n# Subsequent scans compare against baseline (only new findings trigger failures)\ngitleaks detect --source . --baseline-path .gitleaks-baseline.json --exit-code 1\n\n# Review baseline periodically and remove entries as secrets are rotated\ncat .gitleaks-baseline.json | python3 -m json.tool | head -50\n```\n\n### Step 6: Remediate Exposed Secrets\n\nWhen a secret is detected, follow the rotation and history cleanup procedure.\n\n```bash\n# 1. Immediately rotate the exposed credential\n#    - Revoke the old API key\u002Ftoken in the service provider\n#    - Generate a new credential\n#    - Store the new credential in a secrets manager\n\n# 2. Remove secret from git history using git-filter-repo\npip install git-filter-repo\n\n# Create expressions file for secrets to remove\ncat > \u002Ftmp\u002Fexpressions.txt \u003C\u003C 'EOF'\nregex:AKIA[0-9A-Z]{16}==>REDACTED_AWS_KEY\nregex:(?i)password\\s*=\\s*\"[^\"]*\"==>password=\"REDACTED\"\nEOF\n\ngit filter-repo --replace-text \u002Ftmp\u002Fexpressions.txt --force\n\n# 3. Force-push the cleaned history (coordinate with team)\n# git push --force --all  # WARNING: Requires team coordination\n\n# 4. Add the secret pattern to .gitleaks.toml rules\n# 5. Update the baseline file to remove the resolved finding\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Secret | Any credential, token, key, or sensitive string that should not appear in source code |\n| Pre-commit Hook | Git hook that runs before a commit is created, blocking commits containing detected secrets |\n| Entropy | Measure of randomness in a string; high-entropy strings are more likely to be secrets |\n| Baseline | Snapshot of existing findings used to differentiate new secrets from pre-existing ones |\n| Allowlist | Configuration specifying paths, patterns, or commits to exclude from detection |\n| SARIF | Static Analysis Results Interchange Format for uploading findings to security dashboards |\n| git-filter-repo | Tool for rewriting git history to remove sensitive data from all commits |\n\n## Tools & Systems\n\n- **Gitleaks**: Open-source secret detection tool supporting pre-commit hooks, CI\u002FCD, and historical scanning\n- **pre-commit**: Framework for managing and maintaining multi-language pre-commit hooks\n- **git-filter-repo**: History rewriting tool for removing secrets from git history\n- **TruffleHog**: Alternative secret scanner with verified secret detection capabilities\n- **GitHub Secret Scanning**: Native GitHub feature that detects secrets matching partner patterns\n\n## Common Scenarios\n\n### Scenario: Onboarding Secret Scanning on a Legacy Repository\n\n**Context**: A 5-year-old repository has never been scanned. The team needs to enable secret scanning without blocking all development while historical secrets are rotated.\n\n**Approach**:\n1. Run `gitleaks detect` against full history and generate a baseline JSON file\n2. Triage each finding: classify as active (needs rotation), inactive (already rotated), or false positive\n3. Immediately rotate all active secrets and update consuming services\n4. Commit the baseline file (excluding active secrets that have been fixed)\n5. Enable pre-commit hooks for new development immediately\n6. Add CI\u002FCD scanning with the baseline to catch only new secrets\n7. Progressively reduce the baseline as historical secrets are rotated\n\n**Pitfalls**: Generating a baseline without triaging means accepting risk on unrotated secrets. Never assume a historical secret is inactive without verifying with the service provider. Running git-filter-repo on a shared repository without coordination will cause rebase conflicts for all team members.\n\n## Output Format\n\n```\nGitleaks Secret Scanning Report\n=================================\nRepository: org\u002Fweb-application\nScan Type: Full History\nCommits Scanned: 4,523\nDate: 2026-02-23\n\nFINDINGS:\n  Total: 12\n  New (not in baseline): 3\n  Baseline (pre-existing): 9\n\nNEW FINDINGS (blocking):\n  [1] AWS Access Key ID\n      Rule: aws-access-key-id\n      File: src\u002Fconfig\u002Faws.py:23\n      Commit: a1b2c3d (2026-02-22, dev@company.com)\n      Secret: AKIA...REDACTED\n      Entropy: 3.8\n\n  [2] GitHub Personal Access Token\n      Rule: github-pat\n      File: scripts\u002Fdeploy.sh:15\n      Commit: d4e5f6g (2026-02-21, ops@company.com)\n      Secret: ghp_...REDACTED\n      Entropy: 4.2\n\n  [3] Internal API Token\n      Rule: internal-api-token\n      File: src\u002Fservices\u002Fauth.py:89\n      Commit: h7i8j9k (2026-02-20, dev@company.com)\n\nQUALITY GATE: FAILED (3 new findings)\nAction: Rotate exposed credentials immediately.\n```\n","# Implementing Secret Scanning with Gitleaks\n\n## When to Use\n\n- When developers may accidentally commit API keys, passwords, tokens, or private keys to repositories\n- When establishing pre-commit gates that prevent secrets from entering the git history\n- When scanning existing repository history for previously committed secrets that need rotation\n- When compliance requirements mandate secret detection across all source code repositories\n- When migrating from manual secret audits to automated continuous scanning\n\n**Do not use** for detecting secrets in running applications or memory (use runtime secret detection), for managing secrets after detection (use Vault or AWS Secrets Manager), or for scanning container images (use Trivy or Grype).\n\n## Prerequisites\n\n- Gitleaks v8.18+ installed via binary, Go install, or Docker\n- Pre-commit framework installed for local hook integration\n- Git repository with history to scan\n- CI\u002FCD platform access (GitHub Actions, GitLab CI, or equivalent)\n\n## Workflow\n\n### Step 1: Install and Run Initial Repository Scan\n\nPerform a baseline scan of the repository to identify all existing secrets in the git history.\n\n```bash\n# Install Gitleaks\nbrew install gitleaks  # macOS\n# or download binary from https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\u002Freleases\n\n# Scan entire git history for secrets\ngitleaks detect --source . --report-format json --report-path gitleaks-report.json -v\n\n# Scan only staged changes (for pre-commit)\ngitleaks protect --staged --report-format json --report-path gitleaks-staged.json\n\n# Scan specific commit range\ngitleaks detect --source . --log-opts=\"HEAD~10..HEAD\" --report-format json\n\n# Scan without git history (filesystem only)\ngitleaks detect --source . --no-git --report-format json\n```\n\n### Step 2: Configure Pre-Commit Hook\n\nSet up Gitleaks as a pre-commit hook to prevent secrets from being committed.\n\n```yaml\n# .pre-commit-config.yaml\nrepos:\n  - repo: https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\n    rev: v8.21.2\n    hooks:\n      - id: gitleaks\n        name: gitleaks\n        description: Detect hardcoded secrets using Gitleaks\n        entry: gitleaks protect --staged --verbose --redact\n        language: golang\n        pass_filenames: false\n```\n\n```bash\n# Install pre-commit framework\npip install pre-commit\n\n# Install hooks defined in .pre-commit-config.yaml\npre-commit install\n\n# Run against all files (not just staged)\npre-commit run gitleaks --all-files\n\n# Test the hook with a deliberate secret\necho 'AWS_SECRET_ACCESS_KEY=\"wJalrXUtnFEMI\u002FK7MDENG\u002FbPxRfiCYEXAMPLEKEY\"' >> test.txt\ngit add test.txt\ngit commit -m \"test\"  # Should be blocked by gitleaks\n```\n\n### Step 3: Integrate into GitHub Actions\n\n```yaml\n# .github\u002Fworkflows\u002Fsecret-scanning.yml\nname: Secret Scanning\n\non:\n  push:\n    branches: [main, develop]\n  pull_request:\n    branches: [main]\n\njobs:\n  gitleaks:\n    name: Gitleaks Secret Scan\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0  # Full history for comprehensive scanning\n\n      - name: Run Gitleaks\n        uses: gitleaks\u002Fgitleaks-action@v2\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}  # Required for gitleaks-action v2\n\n      # Alternative: Run Gitleaks directly\n      - name: Install Gitleaks\n        run: |\n          wget -q https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\u002Freleases\u002Fdownload\u002Fv8.21.2\u002Fgitleaks_8.21.2_linux_x64.tar.gz\n          tar -xzf gitleaks_8.21.2_linux_x64.tar.gz\n          chmod +x gitleaks\n\n      - name: Scan for secrets\n        run: |\n          if [ \"${{ github.event_name }}\" == \"pull_request\" ]; then\n            .\u002Fgitleaks detect \\\n              --source . \\\n              --log-opts=\"${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\" \\\n              --report-format sarif \\\n              --report-path gitleaks.sarif \\\n              --exit-code 1\n          else\n            .\u002Fgitleaks detect \\\n              --source . \\\n              --report-format sarif \\\n              --report-path gitleaks.sarif \\\n              --exit-code 1 \\\n              --baseline-path .gitleaks-baseline.json\n          fi\n\n      - name: Upload SARIF\n        if: always()\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: gitleaks.sarif\n          category: gitleaks\n```\n\n### Step 4: Author Custom Detection Rules\n\nCreate organization-specific rules for internal secret patterns.\n\n```toml\n# .gitleaks.toml\ntitle = \"Organization Gitleaks Configuration\"\n\n[extend]\nuseDefault = true  # Include all default rules\n\n# Custom rule for internal API tokens\n[[rules]]\nid = \"internal-api-token\"\ndescription = \"Internal API token for service-to-service auth\"\nregex = '''(?i)x-internal-token[\"\\s:=]+[\"\\']?([a-zA-Z0-9_\\-]{40,})[\"\\']?'''\nentropy = 3.5\nkeywords = [\"x-internal-token\"]\ntags = [\"internal\", \"api\"]\n\n[[rules]]\nid = \"database-connection-string\"\ndescription = \"Database connection string with embedded credentials\"\nregex = '''(?i)(postgres|mysql|mongodb|redis):\u002F\u002F[^:]+:[^@]+@[^\u002F]+\u002F\\w+'''\nkeywords = [\"postgres:\u002F\u002F\", \"mysql:\u002F\u002F\", \"mongodb:\u002F\u002F\", \"redis:\u002F\u002F\"]\ntags = [\"database\", \"credentials\"]\n\n[[rules]]\nid = \"jwt-secret\"\ndescription = \"JWT signing secret\"\nregex = '''(?i)(jwt[_-]?secret|jwt[_-]?key)[\"\\s:=]+[\"\\']?([a-zA-Z0-9\u002F+_\\-]{32,})[\"\\']?'''\nentropy = 3.0\nkeywords = [\"jwt_secret\", \"jwt-secret\", \"jwt_key\", \"jwt-key\"]\n\n# Allowlist for test files and known safe patterns\n[allowlist]\ndescription = \"Global allowlist\"\npaths = [\n  '''(^|\u002F)test(s)?\u002F''',\n  '''(^|\u002F)spec\u002F''',\n  '''\\.test\\.(js|ts|py)$''',\n  '''\\.spec\\.(js|ts|py)$''',\n  '''__mocks__\u002F''',\n  '''fixtures\u002F''',\n  '''(^|\u002F)vendor\u002F''',\n  '''node_modules\u002F'''\n]\nregexes = [\n  '''EXAMPLE''',\n  '''example\\.com''',\n  '''test[-_]?(key|secret|token|password)''',\n  '''(?i)placeholder''',\n  '''000000+'''\n]\n```\n\n### Step 5: Manage Baselines for Existing Repositories\n\nCreate a baseline of known findings to avoid blocking development while historical secrets are being rotated.\n\n```bash\n# Generate baseline from current state\ngitleaks detect --source . --report-format json --report-path .gitleaks-baseline.json\n\n# Subsequent scans compare against baseline (only new findings trigger failures)\ngitleaks detect --source . --baseline-path .gitleaks-baseline.json --exit-code 1\n\n# Review baseline periodically and remove entries as secrets are rotated\ncat .gitleaks-baseline.json | python3 -m json.tool | head -50\n```\n\n### Step 6: Remediate Exposed Secrets\n\nWhen a secret is detected, follow the rotation and history cleanup procedure.\n\n```bash\n# 1. Immediately rotate the exposed credential\n#    - Revoke the old API key\u002Ftoken in the service provider\n#    - Generate a new credential\n#    - Store the new credential in a secrets manager\n\n# 2. Remove secret from git history using git-filter-repo\npip install git-filter-repo\n\n# Create expressions file for secrets to remove\ncat > \u002Ftmp\u002Fexpressions.txt \u003C\u003C 'EOF'\nregex:AKIA[0-9A-Z]{16}==>REDACTED_AWS_KEY\nregex:(?i)password\\s*=\\s*\"[^\"]*\"==>password=\"REDACTED\"\nEOF\n\ngit filter-repo --replace-text \u002Ftmp\u002Fexpressions.txt --force\n\n# 3. Force-push the cleaned history (coordinate with team)\n# git push --force --all  # WARNING: Requires team coordination\n\n# 4. Add the secret pattern to .gitleaks.toml rules\n# 5. Update the baseline file to remove the resolved finding\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Secret | Any credential, token, key, or sensitive string that should not appear in source code |\n| Pre-commit Hook | Git hook that runs before a commit is created, blocking commits containing detected secrets |\n| Entropy | Measure of randomness in a string; high-entropy strings are more likely to be secrets |\n| Baseline | Snapshot of existing findings used to differentiate new secrets from pre-existing ones |\n| Allowlist | Configuration specifying paths, patterns, or commits to exclude from detection |\n| SARIF | Static Analysis Results Interchange Format for uploading findings to security dashboards |\n| git-filter-repo | Tool for rewriting git history to remove sensitive data from all commits |\n\n## Tools & Systems\n\n- **Gitleaks**: Open-source secret detection tool supporting pre-commit hooks, CI\u002FCD, and historical scanning\n- **pre-commit**: Framework for managing and maintaining multi-language pre-commit hooks\n- **git-filter-repo**: History rewriting tool for removing secrets from git history\n- **TruffleHog**: Alternative secret scanner with verified secret detection capabilities\n- **GitHub Secret Scanning**: Native GitHub feature that detects secrets matching partner patterns\n\n## Common Scenarios\n\n### Scenario: Onboarding Secret Scanning on a Legacy Repository\n\n**Context**: A 5-year-old repository has never been scanned. The team needs to enable secret scanning without blocking all development while historical secrets are rotated.\n\n**Approach**:\n1. Run `gitleaks detect` against full history and generate a baseline JSON file\n2. Triage each finding: classify as active (needs rotation), inactive (already rotated), or false positive\n3. Immediately rotate all active secrets and update consuming services\n4. Commit the baseline file (excluding active secrets that have been fixed)\n5. Enable pre-commit hooks for new development immediately\n6. Add CI\u002FCD scanning with the baseline to catch only new secrets\n7. Progressively reduce the baseline as historical secrets are rotated\n\n**Pitfalls**: Generating a baseline without triaging means accepting risk on unrotated secrets. Never assume a historical secret is inactive without verifying with the service provider. Running git-filter-repo on a shared repository without coordination will cause rebase conflicts for all team members.\n\n## Output Format\n\n```\nGitleaks Secret Scanning Report\n=================================\nRepository: org\u002Fweb-application\nScan Type: Full History\nCommits Scanned: 4,523\nDate: 2026-02-23\n\nFINDINGS:\n  Total: 12\n  New (not in baseline): 3\n  Baseline (pre-existing): 9\n\nNEW FINDINGS (blocking):\n  [1] AWS Access Key ID\n      Rule: aws-access-key-id\n      File: src\u002Fconfig\u002Faws.py:23\n      Commit: a1b2c3d (2026-02-22, dev@company.com)\n      Secret: AKIA...REDACTED\n      Entropy: 3.8\n\n  [2] GitHub Personal Access Token\n      Rule: github-pat\n      File: scripts\u002Fdeploy.sh:15\n      Commit: d4e5f6g (2026-02-21, ops@company.com)\n      Secret: ghp_...REDACTED\n      Entropy: 4.2\n\n  [3] Internal API Token\n      Rule: internal-api-token\n      File: src\u002Fservices\u002Fauth.py:89\n      Commit: h7i8j9k (2026-02-20, dev@company.com)\n\nQUALITY GATE: FAILED (3 new findings)\nAction: Rotate exposed credentials immediately.\n```\n",{"name":5,"tags":52,"author":54,"domain":46,"license":15,"version":55,"nist_csf":56,"subdomain":38,"description":61,"mitre_attack":62},[38,34,32,28,31,53],"secure-sdlc","mahipal","1.0.0",[57,58,59,60],"PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04","This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI\u002FCD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.\n",[63,64,65,66,67],"T1195","T1554","T1059.004","T1003","T1110","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-secret-scanning-with-gitleaks",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-secret-scanning-with-gitleaks",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-secret-scanning-with-gitleaks",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-secret-scanning-with-gitleaks","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",4781,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",4621,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",2298,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",5114,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",7420,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",9999,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-secret-scanning-with-gitleaks\u002Fscripts\u002Fprocess.py",[128,151,175,203,229,255],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[136,137,138,139,140,46,141,142,42,143,144,40,145,39,146,35,147,148,149,150],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","supply-chain","supply-chain-security","attestation","code-signing","cosign","keyless",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[157],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[159,147,160,161,140,162,46,42,163,164,165,166,167,168,169,170,171,172,173,174],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":185,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[181,184],{"categoryNo":182,"categoryName":183,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[169,186,187,188,189,46,190,191,163,192,193,194,195,196,197,198,199,200,201,202],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[209],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,46,214,215,216,217,218,219,220,221,222,223,224,225,166,226,227,228],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":236,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[235],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[237,238,239,46,240,241,242,243,244,245,246,247,248,30,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[140,263,46,264,265,266,267,268,269,270,271,198,272,199,273,274,275,276,277,278],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]