Gitleaks in Woodpecker — Catch Secrets Before They Ship
Syntax errors break builds; leaked secrets break companies. A single API token, SSH private key, or database password accidentally committed to a public repository can lead to compromised cloud infrastructure, catastrophic data breaches, and thousands of dollars in unauthorized compute bills within minutes.
Standard code linters and TypeScript compilers are completely blind to secrets. To guarantee that no sensitive credentials ever slip into our self-hosted Forgejo repositories or public deployments, our Woodpecker CI pipeline executes Gitleaks as an early, unskippable security gate on every push and pull request.
The most common mistake engineers make regarding secret management is assuming that scanning the current working directory is sufficient. A developer accidentally commits a `.env` file or API key, realizes their error thirty seconds later, runs `git rm`, and makes a second commit removing the file.