gitleakslisted

# Gitleaks Find credentials before they reach a remote and the ones that already did; each scope answers a different question, and [secure](../secure/SKILL.md) orders the pass. ## Commands ```bash gitleaks git --redact=100 --staged --verbose # pre-commit: the change about to be committed gitleaks git --redact=100 --log-opts="--max-count=100" --verbose # check:leaks:history: recent commits (bounded, fast) gitleaks git --redact=100 --verbose # full history: the scheduled audit gitleaks dir . --redact=100 --verbose # working tree, including untracked files gitleaks git --redact=100 --report-format sarif --report-path gitleaks.sarif ``` ## Mise Task Expose explicit scopes per [mise](../mise/SKILL.md). The normal gate scans working-tree files and bounded history; the [lefthook](../lefthook/SKILL.md) pre-commit scan calls `check:leaks:staged`. Native Git options handle an unborn `HEAD` without a shell wrapper. ```toml [tasks."check:leaks"] description = "Scan the working tree and recent commits for leaked secrets" depends = ["check:leaks:tree", "check:leaks:history"] [tasks."check:leaks:tree"] description = "Scan working-tree files, including untracked files" run = "gitleaks dir . --redact=100 --verbose" [tasks."check:leaks:history"] description = "Scan the latest 100 commits reachable from HEAD" # An unborn HEAD has no history; check:leaks:tree still scans its files. run = 'gitleaks git