Lion Cipher Lab
Find hardcoded secrets in your code and git history with Gitleaks
- AppSec / DevSecOps
- Beginner
- ~35 min
- Free · no account required
Why it matters
A secret is any credential your code uses to prove who it is: an API key, an access token, a database password, a private key. When one of these gets committed into source code, it does not just sit quietly in your project. Secrets leak into git history, get pushed to shared or public repositories, land in backups, and get copied into logs. Attackers know this, so automated bots constantly scrape public code hosts for exposed keys and can start abusing a leaked credential within minutes of it appearing. Leaked secrets are consistently one of the most common ways real breaches begin, because a…
What you'll learn
- why leaked secrets are a leading breach cause
- installing and running Gitleaks (open source)
- scanning a working tree and a full git history
- reading a secret-scanning finding (rule id, file, line, commit, fingerprint)
- why rotating a leaked secret matters more than deleting the commit
- adding a pre-commit hook and a custom detection rule
- tuning false positives with .gitleaksignore and allowlists
Steps in this lab
- Why a leaked secret is such a big deal
- What Gitleaks is, and installing it
- Plant a fake secret in your OWN repo and scan the working tree
- Commit it, then scan the full git history
- Read the finding
- The most important step: rotate the secret, do not just delete the commit
- Stop the next leak: a pre-commit hook and a custom rule
- Tune out false positives: .gitleaksignore and allowlists
- Where this habit pays off