# secrets/gitleaks-staged

> Scans the staged change for keys, tokens, and passwords before the commit exists.

Scans the staged change for keys, tokens, and passwords before the commit exists.

Part of the [`secrets`](/reference/configurations/secrets/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once for the repository. It runs gitleaks.

## Why

A secret that reaches a commit stays in history after you delete the line, and every clone holds it.

## What to do

Remove the value and load it from the environment. For a reviewed public value, use `gspot ignore` with its reported fingerprint and a reason.

## Example

A staged credential reports a finding. Load it from an environment variable instead, and rotate it if it already leaked.

## Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

```shell
gspot ignore secrets/gitleaks-staged --paths "<glob>" --reason "<why>"
gspot ignore secrets/gitleaks-staged --rule <rule> --reason "<why>"
```