Why I Built a Secret Scanner Instead of Just Using gitleaks

Описание и применение

Маленькая команда создала dotguard – одностраничный сканер секретов, который работает без зависимостей, легко интегрируется в GitHub Actions и автоматически проверяет как текущий код, так и историю, помогая быстро обнаруживать и вращать утечки.

Задача

Small teams with restricted CI environments and a specific Node/Python stack needed a secret scanner that could run offline, be auditable quickly, and target their project layout.

Результат

The team achieved fast, auditable secret scanning that fits into their CI without external dependencies, reducing the risk of leaked credentials and encouraging a culture of automatic rotation.

Рабочий процесс

• 1. Add a GitHub Actions step: - run: npx @wuchunjie/dotguard --report
• 2. Configure path or recursive flags to target specific directories or entire monorepo
• 3. On push, the scan runs automatically; if any findings, the job fails
• 4. Review JSON report to identify file, line, and rule
• 5. Rotate the leaked secret and commit the change
• 6. Re‑run scan to confirm rotation

Доказательства

The scanner assumes your secrets live in one project, and then breaks that assumption on purpose.

Источник

The entire CI integration is one step: a run line that invokes the scanner via npx.

Источник

A security tool has a special trust problem: you are asking it to read your most sensitive files.

Источник