From forge-core
Commit-time secret scanning with gitleaks — prevent credentials from entering git history. USE WHEN scanning for leaked secrets, setting up pre-commit hooks, or auditing repositories for credentials.
npx claudepluginhub n4m3z/forge-coreThis skill uses the workspace's default tool permissions.
Prevent secrets from entering git history using [gitleaks][GITLEAKS].
Guides Next.js Cache Components and Partial Prerendering (PPR): 'use cache' directives, cacheLife(), cacheTag(), revalidateTag() for caching, invalidation, static/dynamic optimization. Auto-activates on cacheComponents: true.
Processes PDFs: extracts text/tables/images, merges/splits/rotates pages, adds watermarks, creates/fills forms, encrypts/decrypts, OCRs scans. Activates on PDF mentions or output requests.
Share bugs, ideas, or general feedback.
Prevent secrets from entering git history using gitleaks.
brew install gitleaks
gitleaks detect --source . --no-git
gitleaks detect --source .
For pre-commit checks where only staged content matters:
gitleaks protect --source . --staged --no-banner
gitleaks protect (vs detect) operates on the working-tree diff and is faster than a full scan when integrated into a pre-commit flow.
If the repo has historical secrets that have been rotated, create a baseline so future scans only flag new leaks:
gitleaks detect --source . --report-path .gitleaks-baseline.json
gitleaks detect --source . --baseline-path .gitleaks-baseline.json
Add to .pre-commit-config.yaml:
- id: gitleaks
name: gitleaks
entry: gitleaks detect --no-banner --no-git -s .
language: system
pass_filenames: false
Config file at the project root for allowlists. Use path exclusions, not fingerprints — fingerprints break when line numbers shift:
[allowlist]
paths = [
"evals/baselines/.*",
"tests/fixtures/.*",
]
Present findings grouped by severity, never echoing the secret value:
## Secret Scan: <repo>
**Mode**: working tree | staged | history
**Findings**: <count>
### Critical (must fix before merge)
- <file>:<line> <rule-id> — short description
### Allowlisted (known safe)
- <file>:<line> <rule-id> — reason
### Recommendation
<fix | baseline | allowlist guidance>
.env, credentials, or API keys — even to private reposbrew install gitleaks) and stop — do not partially scan--no-verify--no-verify for historical secrets that have already been rotated.env file that is not in .gitignore as a configuration issue