Gitleaks

https://github.com/gitleaks/gitleaks

A tool for detecting and preventing hardcoded secrets like passwords, API keys, and tokens in code.

note

Vortex does not install Gitleaks locally. Follow the instructions to install it on your system.

In CI, Gitleaks runs from its official Docker image as part of the security audit workflow.

Usage

gitleaks dir .

Configuration

Global configuration takes place in the .gitleaks.toml file at the repository root (see the configuration documentation). It extends the default rule set with an allowlist for the placeholder values a Drupal project template legitimately contains, so a clean install reports no findings while real secrets are still detected.

Ignoring

To ignore a single line, add a gitleaks:allow comment to it:

$settings['example'] = 'not-a-real-secret'; // gitleaks:allow

To ignore a path or a recurring known-safe value across the codebase, add it to the .gitleaks.toml file.

Ignoring fail in continuous integration pipeline

This tool runs in continuous integration pipeline by default and fails the build if there are any violations.

Set VORTEX_CI_GITLEAKS_IGNORE_FAILURE environment variable to 1 to ignore failures. The tool will still run and report violations, if any.