Tools · Secrets and dependency scanning · 19 / 26
gitleaks: the line number is in that commit
The line number on a gitleaks finding is the line in the file as that commit stored it. The same path in today’s checkout can sit on a different line. Write the commit with the number, and do not read today’s file as the match.
The number belongs to that revision
A history finding names a commit, a path, and a line. Those three locate the match in that revision. Later commits can insert or delete lines above it, so the same path in the checkout you have open can show different text at that line number.
Opening the file without the commit checks out a different revision. If the text there does not match what the report described, you are not looking at the finding.
Today’s line is a different read
If you need the bytes that matched, check out that commit, or show the file at that commit, and then read the line. A clean working tree does not move the finding. It only means the tip does not contain the same line in the same place.
Do not edit the finding’s line number so it points at whatever is on the tip. The number in the report stays the number in the report.
What to file
File the commit, the path, and the line as one location. If you also looked at the tip, file that as a separate read and say the line numbers disagreed. If you did not open the commit, write “match text not opened at that commit.”
Worked case: line 18 on the tip is a heading
A lab history finding says path README.md, line 18, commit a1b2c3d. On the tip, line 18 is a heading added last week. The match text is not in that heading. A draft says the heading is the secret because the line numbers match.
The note keeps commit a1b2c3d with line 18. The tip read is labeled as the tip, and its line 18 is a heading, not the match. The finding is not moved onto the heading.
commit: a1b2c3d path: README.md line in that commit: 18 tip line 18: a heading added later write: the finding is the commit’s line not: the heading is the match
Diagram
The same path in two revisions
The line number travels with the commit, not with today’s checkout.
Line 18. The line the finding names
Text. What that revision stored there
Use. When you describe the match
Line 18. Whatever is there now
Text. Can be a heading or nothing related
Use. Only if you label it as the tip
Check yourself
1. A finding says README.md line 18 in commit a1b2c3d. Where is that line?
2. The tip’s line 18 is a heading. What do you call it?
3. You have not opened the file at the commit. What do you write?