Guard Kit: stop secrets before they reach git

Free. ShipLatch scans what your live site serves. The Guard Kit catches keys earlier, on your machine and in GitHub, before they get committed or deployed. It's a thin wrapper around gitleaks, the open-source secret scanner, with setup you can copy and paste.

1. Block secrets on every commit (2 minutes)

Add this file to the root of your repo:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.1
    hooks:
      - id: gitleaks

Then run:

pip install pre-commit   # or: brew install pre-commit
pre-commit install         # now every git commit is checked for secrets

2. Check every push and pull request in GitHub

# .github/workflows/guard-kit.yml
name: Guard Kit (gitleaks)
on: [push, pull_request]
jobs:
  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Repos owned by a GitHub organization also need GITLEAKS_LICENSE (free key from gitleaks.io).

3. Check the history you already have

# One-off check of your whole git history (macOS: brew install gitleaks)
gitleaks git -v .

If it finds a real key, rotate it. Deleting it from the code doesn't take back a key that's already in git history.

4. Keep env files out of git

# .gitignore
.env
.env.*
!.env.example
.DS_Store

Using Lovable, Bolt or Replit?

If your project syncs to GitHub, step 2 works as is. If not, paste this into your builder: "Make sure no API keys or secrets are in the frontend code or committed files. Move them to server-side secrets and add .env to .gitignore."