secrets/gitleaks-pushed
Scans every commit about to be pushed for keys, tokens, and passwords.
Part of the secrets configuration, at the recommended level. It runs at the push stage, once for pushed history. It runs gitleaks.
A commit made past the hook still reaches the shared branch unless the push checks it.
What to do
Section titled “What to do”Rewrite the commit that holds the value and rotate the secret. For a reviewed historical example, use gspot ignore secrets/gitleaks-pushed --rule <fingerprint> --reason "...".
Example
Section titled “Example”A credential in an earlier commit still reports after you delete it from the working tree. Rotate it, then remove it from history, and coordinate any rewrite of shared commits.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore secrets/gitleaks-pushed --paths "<glob>" --reason "<why>"