Secure › Module 9 › Lesson 2
gitleaks Literacy
Scan git history for leaks — gitleaks on YOUR $REPO only, never stranger repos.
Visual · t17_gitleaks_literacy
gitleaks = secret pattern scan across commits. Original Cyberlium.
Opening
History remembers the key you deleted in the last commit — scanners read history too.
Gitleaks (and similar: trufflehog, git-secrets) regex-scan commits and branches for secret patterns. Run pre-commit or in CI on $REPO; use --redact in shared logs. Learn allowlist for false positives with justification. Scan YOUR forks and lab repos — never mass-scan open-source or employer orgs without permission to hunt 'leaks.' Findings trigger rotation, not public disclosure posts. Defenders automate; attackers mine GitHub — you are on defense side in $REPO.
1. Running gitleaks
gitleaks detect --source. --verbose on $REPO; protect hook before push.
CI job fails on new leaks; baseline grandfather carefully with tickets.
Command guide
Try these commands — Running gitleaks
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Gitleaks — https://github.com/gitleaks/gitleaks (secret scan on YOUR repo) GitHub secret scanning — https://docs.github.com/en/code-security/secret-scanning
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
brew install gitleaks # or go install
macOS:
Command — copy this
brew install gitleaks
Windows:
Command — copy this
choco install gitleaks
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t17-demo" printf '%s ' 'api_key=ghp_demoNOTREAL0000000000000000000000' > "$HOME/cyberlium-lab/t17-demo/leak_demo.env" gitleaks detect --source "$HOME/cyberlium-lab/t17-demo" --no-git -v || echo 'Install gitleaks; remove demo secret after scan'
Primary tools to practice this lesson: gitleaks. Reference sites: Gitleaks (https://github.com/gitleaks/gitleaks); GitHub secret scanning (https://docs.github.com/en/code-security/secret-scanning). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Handling hits
Assume compromised — rotate credential, revoke token, audit usage logs if available.
Remove from history only with team coordination (filter-repo) — rotation first.
3. Scope
YOUR $REPO and course forks. No 'gitleaks all of GitHub' scripts.
Redact findings in mentor submissions — no live secrets in screenshots.
4. What you ship: gitleaks usage notes
Command example + CI placement + redact rule + $REPO-only scope.
5. What you record before the next lesson
Gitleaks notes path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run gitleaks against competitor org repos and post leaks.
Right
Name gitleaks usage. Next: rotation response.
Mission: gitleaks literacy
1) Write gitleaks detect command for $REPO. 2) Where to place in CI/pre-commit. 3) Write NEVER scan stranger orgs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Baseline existing leak in history?”
Knowledge Check
APPLY: gitleaks scans:
Multiple choice
Knowledge Check
APPLY: True or False: Publishing found stranger secrets is OK.
True or False
Knowledge Check
APPLY: On leak find first:
Multiple choice