-
|
Hello, I wanted to ask: When running GitLeaks in VS Code, is any of my code (in particular, my secrets) sent to GitLeaks' servers (or is all the processing done locally on my computer)? Is it the same whether I manually run it using something like "gitleaks detect ..." or whether it gets run through a pre-commit hook? Thank you! |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
@xinxusean gitleaks does everything locally1 👍 Gitleaks doesn't send data off to another place to scan it, and all of the detection rules are bundled in the gitleaks binary. Footnotes
|
Beta Was this translation helpful? Give feedback.
-
|
Thank you @bplaxco - I wanted to also confirm if there's a way to get gitleaks to automatically ignore any secrets in my repo that have been invalidated (e.g. by sending the token to Azure and asking if it's valid or not). If not, is the recommended workflow: I should manually verify if a secret has been invalidated, and if it has, I will add that secret to the allowlist so that gitleaks doesn't flag it anymore. Thank you so much! |
Beta Was this translation helpful? Give feedback.
-
Sorry, no. Currently gitleaks doesn't support validation checks.
Yeah, once you've verified that a secret's been invalidated, you can add it to a |
Beta Was this translation helpful? Give feedback.
-
|
Thank you so much! |
Beta Was this translation helpful? Give feedback.
@xinxusean gitleaks does everything locally1 👍 Gitleaks doesn't send data off to another place to scan it, and all of the detection rules are bundled in the gitleaks binary.
Footnotes
So for VS Code it'd be your laptop, and for an Azure Pipeline it'd be done on the pipeline's agent ↩