Evaluate adopting a secret scanner for local pre-commit / pre-push and ad-hoc audit of repos and dotfiles.
Candidates (re-evaluate at decision time)
gitleaks — fast regex-based scanner; TOML rules, .gitleaksignore, baseline file support; cheap to wire into a pre-commit hook.trufflehog — regex + live credential verification (calls vendor APIs to check if a leaked key still works); slower but lower false-positive rate; scans beyond git (S3, Docker, filesystems, CI logs).
Decide
- Pick one as the default; running both is overkill for a personal setup.
- Likely split:
gitleaks as the always-on pre-commit gate (latency budget), trufflehog as an on-demand audit tool.
- If adopted: add to
Brewfile, wire pre-commit hook (global template or per-repo), update CLAUDE.md.
Out of scope
- Org-wide CI integration — this is dotfiles only.
- Don't bundle with unrelated tool swaps.
Evaluate adopting a secret scanner for local pre-commit / pre-push and ad-hoc audit of repos and dotfiles.
Candidates (re-evaluate at decision time)
gitleaks— fast regex-based scanner; TOML rules,.gitleaksignore, baseline file support; cheap to wire into a pre-commit hook.trufflehog— regex + live credential verification (calls vendor APIs to check if a leaked key still works); slower but lower false-positive rate; scans beyond git (S3, Docker, filesystems, CI logs).Decide
gitleaksas the always-on pre-commit gate (latency budget),trufflehogas an on-demand audit tool.Brewfile, wire pre-commit hook (global template or per-repo), update CLAUDE.md.Out of scope