Security Leak Guardrails

Reusable workflow for preventing secrets from entering git and for continuously scanning a repo for leaks.

Quick start

1. Inventory existing security tooling (gitleaks/trufflehog, hooks, workflows, dependabot).
2. Add forbidden-path checks and the hook script.
3. Add gitleaks config and a local security check script.
4. Add CI secret scanning and Dependabot.
5. Update .gitignore and document the policy.

Workflow

Step 1: Inventory

• Check for existing .gitleaks.toml, .github/workflows/secret, dependabot.yml, and hook tooling.
• If the repo already uses hooks (husky/lefthook/pre-commit), integrate instead of replacing.