From 3fc81c9aae8a1f9bc8afaa0a1e202a7acdcde11d Mon Sep 17 00:00:00 2001
From: "mendral-app[bot]" <233154221+mendral-app[bot]@users.noreply.github.com>
Date: Thu, 5 Feb 2026 09:19:17 -0800
Subject: [PATCH] Add gitleaks secret scanning

- Add .gitleaks.toml with default rules for secret detection
- Add .pre-commit-config.yaml with gitleaks hook for local scanning
- Add GitHub Actions workflow to scan on push and PR

Uses gitleaks CLI directly to avoid license requirement for organizations.
---
 .github/workflows/gitleaks.yml | 25 +++++++++++++++++++++++++
 .gitleaks.toml                 |  4 ++++
 .pre-commit-config.yaml        |  5 +++++
 3 files changed, 34 insertions(+)
 create mode 100644 .github/workflows/gitleaks.yml
 create mode 100644 .gitleaks.toml
 create mode 100644 .pre-commit-config.yaml

diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
new file mode 100644
index 0000000..ad63cdf
--- /dev/null
+++ b/.github/workflows/gitleaks.yml
@@ -0,0 +1,25 @@
+name: gitleaks
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  scan:
+    name: Secret Scanning
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.18.1/gitleaks_8.18.1_linux_x64.tar.gz | tar -xz
+          chmod +x gitleaks
+          sudo mv gitleaks /usr/local/bin/
+
+      - name: Run gitleaks
+        run: gitleaks detect --source . --verbose --redact
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..be0fd08
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,4 @@
+title = "gitleaks config"
+
+[extend]
+useDefaultRules = true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..aa304e8
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.1
+    hooks:
+      - id: gitleaks