GitLab

How to scan a full commit history to detect sensitive secrets

Feb 6, 2025Noah Ing
How to scan a full commit history to detect sensitive secrets
SummaryAI, from the source post

Introduces the `SECRET_DETECTION_HISTORIC_SCAN` variable for GitLab Secret Detection, enabling scans of the full commit history across all branches. This addresses the risk of secrets remaining in deleted files or old branches. The post details how to enable this feature via `.gitlab-ci.yml` and showcases example results, including a password in a deleted file and an AWS Access Token in a feature branch. It also reiterates existing secret detection features like push protection, pipeline scanning, client-side detection, and automatic response to leaked secrets.

More from the GitLab Secrets Manager trail