How to Scan a GitHub Repo for Secrets: The Complete Guide

TL;DR: To scan a GitHub repo for secrets, use tools like GitLeaks, truffleHog, or OverMCP to automatically scan your repo's git history for API keys, tokens, and other sensitive data. Run them locally or integrate them into your CI/CD pipeline to catch leaks before they cause a breach.

Why You Need to Scan GitHub Repos for Secrets

Vibe coding with AI tools like Cursor, Bolt.new, or GitHub Copilot is incredibly fast. But in the rush to ship, developers often accidentally commit secrets — API keys, database passwords, Stripe tokens, JWT secrets — directly into the codebase. A single leaked secret can lead to account takeover, data breaches, or massive cloud bills.

Scanning your GitHub repo for secrets is not optional. It's a critical step in any security workflow, especially for solo makers and small teams who don't have a dedicated security engineer.

How to Scan a GitHub Repo for Secrets: Step-by-Step

1. Use GitLeaks (Open Source)

GitLeaks is a popular open-source tool that scans git repositories for secrets. It checks the entire commit history, not just the current state.

Installation:

# macOS
brew install gitleaks

# Linux (download binary)
wget https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks-linux-amd64 -O gitleaks
chmod +x gitleaks

Scan a local repo:

gitleaks detect --source=/path/to/repo -v

Scan a remote repo (without cloning):

gitleaks detect --repo=https://github.com/username/repo.git

Example output:

○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○
    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○
    ○    gitleaks    ○
    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○    ○
○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○

Finding:     AWS Access Key ID
Secret:      AKIAIOSFODNN7EXAMPLE
Commit:      a1b2c3d4...
File:        config/aws.yml

2. Use truffleHog (Open Source)

truffleHog is another powerful secret scanner that uses entropy and regex detection.

Installation:

pip install truffleHog

Scan a repo:

trufflehog git https://github.com/username/repo.git --only-verified

The --only-verified flag checks if the secret is actually valid (e.g., it tries to use the API key). This reduces false positives.

3. Use GitHub's Built-in Secret Scanning

GitHub offers free secret scanning for public repositories. It automatically detects patterns for over 200+ secret types from major services.

Enable it:

Limitations: GitHub's scanning only runs on pushed commits — it doesn't catch secrets already in history. For a full audit, use a dedicated tool.

4. Automate Scanning with CI/CD

To prevent secrets from ever reaching production, integrate secret scanning into your CI pipeline.

GitHub Actions example with GitLeaks:

Create .github/workflows/secret-scan.yml:

name: Secret Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Run GitLeaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

This action will fail the build if any secrets are detected, preventing the merge.

5. Use OverMCP for Automated, Continuous Scanning

OverMCP is a security scanning platform designed for vibe-coded apps. It automatically scans your GitHub repos for secrets, API keys, and other vulnerabilities every time you push. Unlike manual tools, OverMCP runs in the background and alerts you instantly via Slack or email. It's built for indie makers who want security without the overhead.

What Secrets to Look For

Common secrets that end up in repos:

Real-World Example: Leaked Stripe Key

Imagine you built a SaaS with Bolt.new and committed a .env file containing:

STRIPE_SECRET_KEY=sk_live_4eC39HqLyjWDarjtT1zdp7dc

A scanner like GitLeaks would detect this immediately:

gitleaks detect --source=. --report=leaks.json

You'd see:

"Match": "sk_live_4eC39HqLyjWDarjtT1zdp7dc",
"File": ".env"

Then you'd need to:

How to Remove Secrets from Git History

If a secret is already in your repo's history, you need to purge it.

Using git filter-branch (simple but destructive):

git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch .env" \
  --prune-empty --tag-name-filter cat -- --all

Using BFG Repo-Cleaner (faster):

java -jar bfg.jar --delete-files .env my-repo.git

After cleanup, force push:

git push origin --force --all
git push origin --force --tags

Important: Anyone who cloned the repo before the cleanup still has the secret. Rotate the leaked secret immediately.

Preventing Secrets in the First Place

Use .gitignore

# .gitignore
.env
*.local
secrets.*

Use Pre-commit Hooks

Install a pre-commit hook that runs a secret scan before every commit:

pip install pre-commit
# Add to .pre-commit-config.yaml
- repo: https://github.com/gitleaks/gitleaks
  rev: v8.16.1
  hooks:
  - id: gitleaks

Use Environment Variables Properly

Never hardcode secrets. Use environment variables in your deployment platform (Vercel, Heroku, etc.) and access them in code:

const stripeKey = process.env.STRIPE_SECRET_KEY;

Conclusion

Scanning your GitHub repo for secrets is a simple but critical step in securing your vibe-coded app. Use GitLeaks or truffleHog for manual scans, integrate them into CI/CD for automation, and consider a platform like OverMCP for continuous monitoring. Don't wait for a breach — scan your repos today.

FAQ

What is the best tool to scan a GitHub repo for secrets?

GitLeaks is the most popular open-source option due to its speed, regex support, and CI integration. For automated, continuous scanning with alerts, consider OverMCP.

Can I scan a private GitHub repo for secrets?

Yes, you can scan any repo you have access to. Use GitLeaks with a personal access token: gitleaks detect --repo=https://TOKEN@github.com/username/private-repo.git.

How do I prevent false positives when scanning for secrets?

Use entropy-based tools like truffleHog with --only-verified to check if the secret is actually valid. Also, add custom allowlists in GitLeaks for known false positives.