Integrations
Integrations
secret-scan does not scan and calls no service. These are the tools it sits between.
- 01
gitleaks
The scanner (required). gitleaks scans with the generated config; the gitleaks filter classifies its JSON report.
- 02
trufflehog
A second scanner (optional). Pipe trufflehog’s NDJSON into the trufflehog filter.
- 03
GitHub Actions
Where the gate runs. A copy-paste job installs the package into a scratch directory, scans the full history, filters and fails on private findings.
- 04
GitHub Packages
Where the package is published.
@catesworks/secret-scanis a restricted package on GitHub Packages, not on the public npm registry. - 05
git
Source of line-bound checks. The gitleaks filter reads source lines from git objects to check line-bound exceptions.