# secrets/gitleaks-pushed

> Scans every commit about to be pushed for keys, tokens, and passwords.

Scans every commit about to be pushed for keys, tokens, and passwords.

Part of the [`secrets`](/reference/configurations/secrets/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `push` [stage](/start/concepts/#stage), once for pushed history. It runs gitleaks.

## Why

A commit made past the hook still reaches the shared branch unless the push checks it.

## What to do

Rewrite the commit that holds the value and rotate the secret. For a reviewed historical example, use `gspot ignore secrets/gitleaks-pushed --rule <fingerprint> --reason "..."`.

## Example

A credential in an earlier commit still reports after you delete it from the working tree. Rotate it, then remove it from history, and coordinate any rewrite of shared commits.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore secrets/gitleaks-pushed --paths "<glob>" --reason "<why>"
```