gitleaks

• Category: secrets (pre-receive hook, in-process)
• Fingerprint: rule-file-surrounding-3-lines-v1
• License: MIT (linked into the server binary)

Vetrix runs gitleaks in-process on every push. The hook rejects the push with a structured message when any rule fires. No CI round trip.

When to enable

Always. Secrets at pre-receive is the cheapest guardrail in the stack.

Tuning

.vetrix/tooling.yml:

secrets:
  enabled: true
  gitleaks:
    enabled: true
    rulesets: [default, aws]
    severity: high

rulesets references the vendored catalog. Adding custom rules lives in a repo-side .gitleaks.toml.

Common false positives

• Test fixtures with synthetic JWTs → add a path-allowlist entry in .gitleaks.toml for the testdata/ subtree.
• Placeholders like YOUR_API_KEY_HERE → gitleaks's own stopwords list catches most of these.

Emergency bypass

A vetrix.security.emergency_bypass setting exists at the instance level. Granted via PermSecretBypass only; bypass is recorded in the audit log.