Skip to content

security.md

Latest commit

 

History

History
68 lines (47 loc) · 1.84 KB

security.md

File metadata and controls

68 lines (47 loc) · 1.84 KB
Raw

Security

Secret scanning

This repository uses Gitleaks with .gitleaks.toml as the single rule source.

flowchart LR
  Change[config/code/docs change] --> Staged[pnpm secrets:scan:staged]
  Staged --> Commit{clean?}
  Commit -- yes --> Push[push/PR]
  Commit -- no --> Remove[remove secret and rotate if exposed]
  Push --> Full[pnpm secrets:scan in pnpm verify]
Loading

Install local hooks after cloning:

pnpm hooks:install

The project uses Husky for local git hooks. The prepare script also runs Husky after dependency installation.

Run a full repository scan:

pnpm secrets:scan

Run the staged pre-commit scan manually:

pnpm secrets:scan:staged

The hooks fail closed. If gitleaks is not installed, git commit and git push fail with an installation prompt instead of silently skipping the scan.

Handling findings

flowchart TD
  Finding[Gitleaks finding] --> Real{real secret?}
  Real -- yes --> Remove[remove from change]
  Remove --> Rotate[rotate credential if committed or shared]
  Real -- no --> Placeholder[prefer placeholder or narrow rule]
  Placeholder --> Targeted[only targeted allowlist if needed]
Loading

If Gitleaks reports a real secret, remove it from the change and rotate the credential if it was ever committed or shared.

If Gitleaks reports a false positive, prefer one of these fixes:

  1. Replace the value with an obvious placeholder such as example, changeme, or ${ENV_VAR}.
  2. Narrow the rule in .gitleaks.toml.
  3. Add a targeted allowlist entry with a clear description.

Do not add broad allowlists for whole source directories.

Risky bypass

For emergency local work only, hooks can be skipped explicitly:

SKIP_GITLEAKS=1 git commit -m "message"
SKIP_GITLEAKS=1 git push

This is a risk operation. Run pnpm secrets:scan before sharing the branch.