Skip to content

README-secret-scanning.md

Latest commit

 

History

History
84 lines (56 loc) · 3.08 KB

README-secret-scanning.md

File metadata and controls

84 lines (56 loc) · 3.08 KB

Task INC-3: Implement Secret Scanning (Pre-Commit & CI) — Issue #25

Webeet.io · DevSecOps Internship · Jan 2026
✅ Closed as completed — Status: Done
Parent Epic: SEC-INC: Secret Leak Remediation & Hardening #22
Assigned to: sergepatrickdim-lgtm

Context

A real GCP credential leak was detected in the codebase. This task was created to prevent future secret leaks at both commit time and CI/CD pipeline level — closing the gap permanently by automating detection before secrets ever reach the remote repository.

Problem

Secrets (API keys, cloud credentials, high-entropy strings) were being committed to the repository without any automated detection. There was no gate at commit time and no check in the CI pipeline, leaving the codebase exposed to accidental credential exposure.

Solution

1. CI Pipeline — .github/workflows/secret-scanning.yml

  • Integrated Gitleaks v8.21.2 into the GitHub Actions CI workflow
  • Triggers on push to development branch and all pull_request events
  • Runs on ubuntu-latest with contents: read permissions
  • Installs Gitleaks from official GitHub release, runs gitleaks detect --source . --verbose --redact
  • Pipeline fails the build if any high-entropy strings or known key patterns are detected
  • Covers AWS, GCP, Azure keys and generic high-entropy secrets
  • 2 commits · 3 files changed · +63 / -16

2. Pre-Commit Hooks

  • Configured pre-commit hooks to scan for secrets before any commit is accepted locally
  • Scans for JSON key patterns
  • Blocks commits containing potential secrets
  • Prevents secrets from ever reaching the remote repository

3. .gitignore Update — PR #41

As part of the implementation, resolved a .gitignore merge conflict (scope-limited) to ensure the following files are properly excluded from the repository:

  • gitleaks-baseline.json — Gitleaks baseline config
  • replacements.txt — secret replacement patterns
  • docker-test.txt / docker-write-test.txt — local test artifacts

Branch: feature/INC-3-secret-scanning-clean-minimal → main
Commit 9875aaa · Feb 6, 2026 · +5 / -1

Acceptance Criteria — All Met ✅

  • Add Gitleaks to the CI pipeline (GitHub Actions)
  • Fail the build if high-entropy strings or known key patterns are detected
  • Add Pre-Commit Hooks to scan for JSON key patterns
  • Block commits containing potential secrets

Timeline

Date Action
Jan 20 Issue opened by AlejandroRomanIbanez
Jan 26 Self-assigned by sergepatrickdim-lgtm
Jan 27 Moved to In Progress
Jan 27 Moved to Done — closed as completed

Tech Stack

Gitleaks · GitHub Actions · Pre-commit · CI/CD · DevSecOps

Screenshots

See /screenshots/ folder — includes issue overview, acceptance criteria, and completion status.

Part of a DevSecOps internship at Webeet.io (Jan 2025 – Mar 2026). Code belongs to Webeet.io — this repo documents the work via issue screenshots and technical write-up.