Secret scan: gitleaks' default rules, which it had none of
The required secret scan has been running with no rules. gitleaks adds its default rules to a config file only when the file says [extend] useDefault = true. .gitleaks.toml held only an allowlist, so the scan could find nothing: every "no leaks found" in CI meant only that.
Evidence (gitleaks 8.30.1, as CI pins): I scanned a canary file holding a fake AWS access key and a fake GitHub token, three ways:
| Config | Result |
|---|---|
The repo's .gitleaks.toml | no leaks found |
| No config (gitleaks' defaults) | leaks found: 2 |
The repo's config with useDefault = true | leaks found: 2 |
Found by the security pass on #137, "Run each deterministic Lens from the base's inputs".
What changes
-
.gitleaks.toml:[extend] useDefault = true, with a comment saying why. -
.gitleaksignore: turning the rules on finds four findings in history, all fake secrets in the tests:curl -u someone:hunter2secretintests/test_hooks.py;- a split-up
access_token=a1…intests/test_tools.py's redaction cases.
Each is ignored by its exact fingerprint (commit, file, rule, line), not by path, so a new secret in those files is still caught.
-
tests/test_tools.py::test_the_secret_scan_has_rules: fails if the defaults are not extended, or a default rule is switched off. It also requires each ignore entry to be one exact fingerprint.
Verified: make verify passes on a git archive export. With the new config, the canary gives two leaks and the repo's whole history gives none.
Order: this should merge before #137. That PR makes the scan read the base's .gitleaks.toml, so its own fix would not apply to itself.
.gitleaks.toml is a Lens input, so this change needs the model review.
🤖 Generated with Claude Code
Summary by CodeRabbit
- Security
- Secret scans now include the standard detection rules, broadening coverage.
- Specific findings in test files are excluded from scan results to prevent known test content from being repeatedly flagged.
- Tests
- Added checks to verify that the scan configuration keeps standard rules enabled and that exclusions follow the expected format.