secrets/gitleaks-staged
Scans the staged change for keys, tokens, and passwords before the commit exists.
Part of the secrets configuration, at the recommended level. It runs at the commit stage, once for the repository. It runs gitleaks.
A secret that reaches a commit stays in history after you delete the line, and every clone holds it.
What to do
Section titled “What to do”Remove the value and load it from the environment. For a reviewed public value, use gspot ignore with its reported fingerprint and a reason.
Example
Section titled “Example”A staged credential reports a finding. Load it from an environment variable instead, and rotate it if it already leaked.
Turn it off
Section titled “Turn it off”Turn it off for some files, or one of its lint rules, with a reason:
gspot ignore secrets/gitleaks-staged --paths "<glob>" --reason "<why>"gspot ignore secrets/gitleaks-staged --rule <rule> --reason "<why>"