Enable gitleaks decoding at depth 2 and report encoding (boostsecurityio/workspace#73) - #269
Merged
Merged
Conversation
lindycoder
marked this pull request as ready for review
July 20, 2026 20:24
…yio/workspace#73) Add `--max-decode-depth=2` to the gitleaks scan command in both the `gitleaks` (dir) and `gitleaks-full` (git) modules so gitleaks decodes and scans base64/hex/percent/unicode-encoded content at depth 2, surfacing nested secrets as findings. Bump the `boost-scanner-gitleaks` post-processor image in both modules to the build that parses the decode tags into the `encoding` field, so the newly-detected nested secrets are reported with their encoding metadata. The `boost-scanner-keyscope` post-processor image is unchanged. WARNING: the new public.ecr.aws/boostsecurityio/boost-scanner-gitleaks:f89b028 image is a TEMPORARY testing pin - the raw CI build of the PR #34 branch, used for pre-merge validation only. It must be swapped to the ghcr.io main-published image before this PR is merged. Keep this PR in draft until that swap lands. Part of boostsecurityio/workspace#73
…ain-built ghcr prod digest Now that boostsec-scanner-gitleaks PR #34 is merged to main and its production ghcr image is published and cosign-signed, replace the pre-merge ECR testing pin (public.ecr.aws/…/boost-scanner-gitleaks:f89b028) with the production ghcr image built from main (ghcr.io/boostsecurityio/scanner-publishing/boost-scanner-gitleaks:3317798) in both the gitleaks and gitleaks-full modules. 3317798 is the squash SHA of #34 on scanner-gitleaks main — the same tag-parsing code validated via the f89b028 branch build, now the main-built prod equivalent on the same ghcr scanner-publishing path the module already uses. The --max-decode-depth=2 scan-command flags and the boost-scanner-keyscope image are unchanged. No ECR reference remains. Part of boostsecurityio/workspace#73
lindycoder
force-pushed
the
73-enable-gitleaks-decoding
branch
from
July 22, 2026 14:34
e139afb to
8b568da
Compare
Talgarr
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two coordinated changes to both production gitleaks modules
(
boostsecurityio/gitleaksandboostsecurityio/gitleaks-full):--max-decode-depth=2to the gitleaks scancommand. This makes gitleaks decode and scan base64 / hex / percent /
unicode-encoded content up to depth 2, so nested/encoded secrets are
surfaced as findings.
boost-scanner-gitleakspost-processor image to the build that parses the gitleaks decode tags
into the SARIF
encodingfield, so the newly-detected nested secretscarry their encoding metadata downstream.
Both are required for "detect and report": the flag alone finds the
nested secrets, but they'd carry no encoding metadata until the
post-processor image is bumped.
The
boost-scanner-keyscopepost-processor image is intentionallyunchanged in both files.
Post-processor image
Pinned to the production image built from
boostsec-scanner-gitleaksmain(PR #34, merged):
ghcr.io/boostsecurityio/scanner-publishing/boost-scanner-gitleaks:3317798@sha256:c5c0234223df2c08171a6c01f15e45870a841e5a5e84c09e535981baf6ab8d0a— built, cosign-signed, and mirrored to ghcr through the standard
scanner-publishing path. Validated end-to-end against a repo with encoded
secrets before merge.
Part of boostsecurityio/workspace#73