Grep git history and CI for leaked secrets

Jul 1, 2026 · 1 min read

Secrets removed from HEAD often remain in old commits and CI logs. Scan the full history and the pipeline config.

bash

gitleaks detect --source . --log-opts="--all"
trufflehog git file://. --only-verified

Also check CI files for inline credentials and dangerous triggers.

bash

grep -rEn "AKIA[0-9A-Z]{16}|xox[baprs]-|-----BEGIN|passwords*[:=]" .github/ .gitlab-ci.yml Dockerfile

Pro note: verify each hit; high-entropy strings are often not credentials. For any live secret, note that rotation must happen because the value is permanently in history, and check whether the same key appears in build logs or container image layers.