CME-1012

Pre-commit Secrets Detection (gitleaks/trufflehog)

Detect Application Unquantified evidence Detective

Description

Automated scanning of code commits for embedded secrets (API keys, passwords, private keys, tokens, connection strings) using pattern-based and entropy-based detection. Runs as a git pre-commit hook or CI pipeline gate to prevent hard-coded credentials from reaching repositories where they can be harvested by attackers or leaked in public forks. Tools include gitleaks, trufflehog, and git-secrets. Complements credential rotation and vault-based secret management by catching secrets that bypass those controls at the source code layer.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Hard-coded credentials are detected and blocked before they reach the repository; the attacker must find credentials through an alternative channel (vault compromise, memory dump, network intercept) rather than simply reading source code or commit history

CWE Relationships

CWE-798 CWE-312 CWE-316

Verification

Verify that a secrets scanning tool is configured as a git pre-commit hook or CI pipeline stage and reports no findings

$ test -f .git/hooks/pre-commit && grep -l 'gitleaks\|trufflehog\|git-secrets\|detect-secrets' .git/hooks/pre-commit
# Expected: Pre-commit hook exists and references a secrets scanning tool

Platform: any

$ gitleaks detect --source . --no-git 2>&1 | tail -1
# Expected: no leaks found

Platform: any

$ trufflehog filesystem . --no-update 2>&1 | grep -c 'Found verified result'
# Expected: 0 — no verified secrets found

Platform: any

Remediation

any Gitleaks secrets scanner via pre-commit framework


pip install pre-commit
cat > .pre-commit-config.yaml <<'EOF'
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.2
    hooks:
      - id: gitleaks
EOF
pre-commit install