Detect Secret Leaks in CI with a Pre-Commit Scan

Run a secret scanner on every push, fail the build on a high-confidence finding, and route the alert to the on-call so the leaked credential can be rotated before it is used.

~20 minsecuritysecretsci

Task

Block a push that contains a high-confidence secret and alert the on-call so the credential is rotated, not just the commit reverted.

When to use this

An engineer commits a service key in a config file. The push lands before anyone notices. The team wants the leak caught at push time and the key rotated before an attacker finds it.

Prerequisites

A secret scanner like gitleaks or trufflehog installed in CI
A way to alert the on-call (pager or chat)
A rotation runbook for each credential type

Steps

1. Run the scanner on the diff of every push and fail on a high-confidence finding.

gitleaks git --pre-commit --verbose

Expected output: A clean push passes; a push that adds a high-entropy string matching a known pattern fails with the file and line.

2. Route the failure to the on-call in addition to failing the build, so the credential is rotated.

if (gitleaks.failed) {
  await pager.alert({ severity: "high", message: "secret leaked in " + commit });
  process.exit(1);
}

Expected output: The on-call is paged within a minute of the push, and the build failure blocks the merge.

3. Verify the rotation runbook is linked in the alert so the on-call rotates, not just reverts.

grep -l "rotation" runbooks/ && echo "runbook linked"

Expected output: The alert payload includes a link to the rotation runbook for the detected credential type.

Troubleshooting

Problem

A false positive blocks a legitimate push

Solution

Mark the line with a allowlist comment and record the reason; review allowlisted entries quarterly so they do not accumulate.

Problem

The scanner misses a new secret format

Solution

Add a custom rule for your credential format, and run the scanner on history periodically, not only on the diff.

Limitations

A scanner catches patterns, not secrets that look like ordinary strings; custom rules close part of the gap.
Reverting the commit does not un-leak the secret; rotation is the required response.

Scan the diff, alert the on-call

Run the scanner on every push and fail the build on a high-confidence finding. A build failure alone does not un-leak the secret; page the on-call so the credential is rotated before an attacker uses it.

gitleaks git --pre-commit --verbose

Link the runbook

The alert must link to the rotation runbook for the detected credential type. Reverting the commit is not enough; the secret is already in history and must be treated as compromised.

if (gitleaks.failed) {
  await pager.alert({ severity: 'high', message: 'secret leaked in ' + commit });
  process.exit(1);
}

Expected outcome

A push that adds a high-confidence secret fails the build and pages the on-call within a minute. The alert links to the rotation runbook, the credential is rotated, and the commit is reverted. False positives are allowlisted with a reason and reviewed quarterly.