We use multiple tools to detect secrets and sensitive information in our codebase:

• What it does: Detects secrets using entropy analysis and regex patterns
• Why we use it: Free, no license required, very effective
• Runs on: Every push and pull request via GitHub Actions

• What it does: Detects secrets using configurable rules
• Configuration: .gitleaks.toml in the root directory
• Usage: Primarily for local development

Our security workflow (.github/workflows/security.yml) includes:

1. Secret Detection - Uses TruffleHog + local gitleaks
2. Dependency Scanning - Uses npm audit for vulnerability checking
3. SARIF Upload - Results are uploaded to GitHub Security tab

# Run gitleaks scan
npm run security:scan

# Run TruffleHog scan (requires Docker)
npm run security:trufflehog

# Run both scans
npm run security:full

# Scan only staged files (good for pre-commit)
npm run security:scan-staged

# Create baseline file to ignore existing findings
npm run security:baseline

The precommit script runs automatically before commits to check staged files:

npm run precommit

Our configuration includes:

• Custom rules for Supabase keys
• NextAuth and JWT secret detection
• Allowlist for false positives
• Stopwords to reduce noise

TruffleHog runs with:

• --only-verified flag to reduce false positives
• --debug for detailed output in CI

• Add patterns to the allowlist in .gitleaks.toml
• Use the baseline file for persistent ignores

• Solution: We've switched to TruffleHog for CI/CD
• Local use: Gitleaks is still free for local development

• TruffleHog: Requires Docker for local usage
• Gitleaks: Install via brew install gitleaks or run setup script

1. Never commit secrets - Use environment variables
2. Use .env.local for local development secrets
3. Run security scans before committing
4. Review scan results carefully
5. Update configurations as needed

If secrets are accidentally committed:

1. Immediately rotate the compromised credentials
2. Remove from git history using git filter-branch or BFG
3. Update baseline if needed
4. Notify team about the incident

• TruffleHog Documentation
• Gitleaks Documentation
• GitHub Security Features