detect-secrets scan

detect-secrets scan > .secrets.baseline

Detect secrets with Yelp's detect-secrets, generating the baseline of known findings for pipeline control.

Run it in the CI/CD pipeline when you want detection with the baseline: detect-secrets scans the repo and generates the baseline (.secrets.baseline) with the findings — the first run creates the baseline (known secrets, those that are audited), and the pipeline compares against the baseline: a new secret (outside the baseline) blocks the merge. It's the detector with the baseline flow (from Yelp): incremental control of secrets. In DevSecOps, detect-secrets is the pipeline piece: the versioned baseline and the diff check against it.

Don't use it without the baseline process: the versioned baseline is key — an unaudited baseline (real secrets in it) validates secrets by default; the baseline is audited (findings are reviewed and marked). And watch out: detect-secrets detects patterns from its plugins — custom formats require custom plugins. History scanning isn't its strength (the pipeline scans the diff): history is covered with gitleaks/trufflehog. The first run on a dirty repo generates a large baseline: audit it before versioning.