Problem
CI gates cover supply chain (cargo-deny) but nothing guards against a secret or credential landing in a commit. History is clean today (scanned); the gap is preventive, not corrective.
Proposal
- A
gitleaks job in ci.yml (gitleaks/gitleaks-action, fetch-depth: 0) on PRs and pushes.
- Failing the job blocks merge via the existing required-checks ruleset once added to the required contexts.
Notes
A security tool scanning itself for leaked secrets is table stakes — same reasoning as the existing cargo-deny gate.
Problem
CI gates cover supply chain (
cargo-deny) but nothing guards against a secret or credential landing in a commit. History is clean today (scanned); the gap is preventive, not corrective.Proposal
gitleaksjob inci.yml(gitleaks/gitleaks-action,fetch-depth: 0) on PRs and pushes.Notes
A security tool scanning itself for leaked secrets is table stakes — same reasoning as the existing cargo-deny gate.