CME-1012
Pre-commit Secrets Detection (gitleaks/trufflehog)
Description
Automated scanning of code commits for embedded secrets (API keys, passwords, private keys, tokens, connection strings) using pattern-based and entropy-based detection. Runs as a git pre-commit hook or CI pipeline gate to prevent hard-coded credentials from reaching repositories where they can be harvested by attackers or leaked in public forks. Tools include gitleaks, trufflehog, and git-secrets. Complements credential rotation and vault-based secret management by catching secrets that bypass those controls at the source code layer.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Hard-coded credentials are detected and blocked before they reach the repository; the attacker must find credentials through an alternative channel (vault compromise, memory dump, network intercept) rather than simply reading source code or commit history |
CWE Relationships
Verification
Verify that a secrets scanning tool is configured as a git pre-commit hook or CI pipeline stage and reports no findings
$ test -f .git/hooks/pre-commit && grep -l 'gitleaks\|trufflehog\|git-secrets\|detect-secrets' .git/hooks/pre-commit
# Expected: Pre-commit hook exists and references a secrets scanning tool
# Expected: Pre-commit hook exists and references a secrets scanning tool
Platform: any
$ gitleaks detect --source . --no-git 2>&1 | tail -1
# Expected: no leaks found
# Expected: no leaks found
Platform: any
$ trufflehog filesystem . --no-update 2>&1 | grep -c 'Found verified result'
# Expected: 0 — no verified secrets found
# Expected: 0 — no verified secrets found
Platform: any