Originally published at woitzik.dev
A previous article here covered setting up gitleaks for homelab secret scanning - the setup, the pre-commit hook, getting CI to fail on new commits that contain secrets. The setup was correct. The tool was running. The CI was green. And it had been quietly suppressing a live production credential for months.
This is the follow-on story: not about getting gitleaks running, but about the specific way a baseline file breaks the guarantees you think you have once it's in place.
View the complete homelab infrastructure source on GitHub 🐙
What a Baseline File Does (and Is Supposed to Do)
