Secret scanning

Gitleaks detects and prevents hardcoded secrets like passwords, API keys, and tokens in code.

note

Vortex does not install Gitleaks locally. Follow the instructions to install it on your system.

In CI, Gitleaks runs from its official Docker image as part of the security audit workflow.

Usage

gitleaks dir .

Configuration

Global configuration takes place in the .gitleaks.toml file at the repository root (see the configuration documentation). It extends the default rule set with an allowlist for the placeholder values a Drupal project template legitimately contains, so a clean install reports no findings while real secrets are still detected.

Ignoring

To ignore a single line, add a gitleaks:allow comment to it:

$settings['example'] = 'not-a-real-secret'; // gitleaks:allow

To ignore a path or a recurring known-safe value across the codebase, add it to the .gitleaks.toml file.

Continuous integration

Gitleaks runs in the security audit workflow by default and fails that workflow if there are any violations.

Ignoring failures

Set VORTEX_CI_GITLEAKS_IGNORE_FAILURE environment variable to 1 to ignore failures. The tool will still run and report violations, if any.

➡️ See Ignore tool failures.