API keys, tokens, passwords, and private keys sometimes enter source control through configuration, debugging output, or copied examples. Gitleaks checks for credential-like values before they travel further through delivery systems.

secret-scan:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v7
    - name: Report secret findings
      continue-on-error: true
      run: |
        docker run --rm \
          --user "$(id -u):$(id -g)" \
          --volume "$GITHUB_WORKSPACE:/repo" \
          ghcr.io/gitleaks/gitleaks:v8.30.1 \
          dir --redact --verbose /repo

The dir command scans files in the current checkout, not every historical commit. It is fast, but a credential removed from the latest version can remain in history. Use a full-history scan when establishing a repository baseline or responding to an incident.

Pinning the container version makes results reproducible. --redact prevents the CI log from becoming another location where a detected secret is exposed.

When a secret is found

1. Treat a real credential as compromised.
2. Revoke or rotate it at its provider.
3. Replace it with an approved secret store.
4. Remove it from current files and assess Git history.
5. Review usage logs for unauthorized activity.

Allowlist only verified false positives with narrow, explained rules.