Why I Built a Secret Scanner Instead of Just Using gitleaks

说明与用途

小团队开发了 dotguard，一款零依赖的秘密扫描器，可通过 GitHub Actions 单行步骤在 CI 中运行，扫描当前文件和历史记录，输出 JSON，帮助快速检测和旋转泄露的秘密。

问题

Small teams with restricted CI environments and a specific Node/Python stack needed a secret scanner that could run offline, be auditable quickly, and target their project layout.

结果

The team achieved fast, auditable secret scanning that fits into their CI without external dependencies, reducing the risk of leaked credentials and encouraging a culture of automatic rotation.

工作流

• 1. Add a GitHub Actions step: - run: npx @wuchunjie/dotguard --report
• 2. Configure path or recursive flags to target specific directories or entire monorepo
• 3. On push, the scan runs automatically; if any findings, the job fails
• 4. Review JSON report to identify file, line, and rule
• 5. Rotate the leaked secret and commit the change
• 6. Re‑run scan to confirm rotation

证据

The scanner assumes your secrets live in one project, and then breaks that assumption on purpose.

来源

The entire CI integration is one step: a run line that invokes the scanner via npx.

来源

A security tool has a special trust problem: you are asking it to read your most sensitive files.

来源