Secrets and .env

Turn on secret scanning

Turn on GitHub secret scanning and push protection, or run gitleaks in CI or a pre-commit hook, to block leaked keys before they are pushed.

Why it matters

You will paste a key in the wrong place again. Scanning catches it before or right after the push, while it is still cheap to fix.

How to fix it

1. On GitHub: Settings, Code security, enable Secret Protection (secret scanning) and push protection. They are free for public repositories.
2. For private repos or other hosts, run gitleaks in CI.
3. Optionally add gitleaks as a pre-commit hook so leaks are caught on your machine.

# .github/workflows/gitleaks.yml
name: gitleaks
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

How to verify

• Commit a fake key on a branch; the push or the CI job should be blocked or flagged.

Questions

Is GitHub secret scanning free?

For public repositories, yes. For private repositories it requires a paid GitHub plan; gitleaks is a free alternative.

Related checks

• Keep .env files out of git
• Rotate leaked keys, don't just delete them
• Check every package your AI added

Tick it off in the full checklist