> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/open-source/use-harness-open-source/repositories-1/security.md).

# Security

## Secret Scanning <a href="#secret-scanning" id="secret-scanning"></a>

In Harness Open Source, you can use the integrated [Gitleaks](https://github.com/gitleaks/gitleaks) tool to block secrets like passwords, API keys, and tokens from being pushed to your Git repositories. Enabling secret scanning for individual repositories ensures that any attempt to push a commit containing a [recognized secret pattern](https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml) is denied. This is essential for maintaining the security of your codebase.

{% hint style="warning" %}
Harness Open Source Secret Scanning scans *only new/changed code* in commits that users attempt to push *after* you enable Secret Scanning on a repo. Secrets in existing/unchanged code aren't detected.
{% endhint %}

To enable Secret Scanning:

1. Go to the repository where you want to enable secret scanning and select **Settings**.
2. Select the **Security** tab.
3. Enable **Secret Scanning**.
4. Select **Save**.
5. Repeat to enable Secret Scanning on additional repos.

### Bypass or ignore detected secrets <a href="#bypass-or-ignore-detected-secrets" id="bypass-or-ignore-detected-secrets"></a>

{% hint style="info" %}
Bypassing/ignoring detected secrets is not recommended unless you are certain the detected secret doesn't represent a potential vulnerability, such as test data containing fake secrets.
{% endhint %}

If you want to bypass Gitleaks and knowingly commit a recognized secret, you have two options:

* Add `gitleaks:allow` as a comment in your code.
* Create a `.gitleaksignore` file.

For more information, refer to the [Gitleaks README](https://github.com/gitleaks/gitleaks?tab=readme-ov-file#additional-configuration).