Why I Built a Secret Scanner Instead of Just Using gitleaks

Description and use

A small team built dotguard, a zero‑dependency secret scanner that runs in CI via a single GitHub Actions step, scans both current files and history, outputs JSON, and facilitates quick detection and rotation of leaked secrets.

Problem

Small teams with restricted CI environments and a specific Node/Python stack needed a secret scanner that could run offline, be auditable quickly, and target their project layout.

Outcome

The team achieved fast, auditable secret scanning that fits into their CI without external dependencies, reducing the risk of leaked credentials and encouraging a culture of automatic rotation.

Workflow

• 1. Add a GitHub Actions step: - run: npx @wuchunjie/dotguard --report
• 2. Configure path or recursive flags to target specific directories or entire monorepo
• 3. On push, the scan runs automatically; if any findings, the job fails
• 4. Review JSON report to identify file, line, and rule
• 5. Rotate the leaked secret and commit the change
• 6. Re‑run scan to confirm rotation

Evidence

The scanner assumes your secrets live in one project, and then breaks that assumption on purpose.

Source

The entire CI integration is one step: a run line that invokes the scanner via npx.

Source

A security tool has a special trust problem: you are asking it to read your most sensitive files.

Source