gitleaks: a finding is a match in history, not a live secret

The report is a rule match

Each finding is a place where a rule’s pattern matched a change. RuleID names the rule. File, line, and commit name where. The fingerprint ties those together so the same match can be recognized later. With redaction on, the secret field is masked. The report then proves a match happened. It does not contain a value you can test, and it does not say a provider would accept that value.

A match in an old commit is still a match. It is not, by itself, a statement that the credential is in use today.

Entropy and author are not a verdict

Entropy is a number the rule computed for the matched text. A high number means the text looked random to that rule. It does not mean the text is a credential a service will honor. A tutorial, a fixture, and a real key can all score high.

Author and email are the strings git stored on that commit. They are not a directory lookup, and they are not proof of who knew the value. Quote them as recorded. Do not write a person’s name into the ticket unless you have a second source.

What to file

File the rule id, path, line, commit, date, fingerprint, and whether the report was redacted. File the job that produced it. Do not attach an unredacted report to a ticket. Do not paste the matched text into chat to “see if it works.” Checking whether a value is live is a separate, approved step outside this report, and this lesson does not do it.

Worked case: a placeholder in the docs

A redacted history scan on the lab docs repo reports rule generic-api-key in docs/onboarding.md, commit b2c4e91, author string docs-bot, entropy high, fingerprint b2c4e91:docs/onboarding.md:generic-api-key:18. A draft says the production key is live and names the docs bot as the owner.

The note quotes the rule, path, commit, and fingerprint, and says the report was redacted. The line in that commit is a placeholder the tutorial tells readers to replace. The finding stays a match. It does not say a provider accepted anything, and the author string is not an owner. Rotation is not started from this row alone.

RuleID: generic-api-key
File: docs/onboarding.md  Line: 18
Commit: b2c4e91  Date: 2026-02-02T11:00:00Z
Author: docs-bot (string on the commit)
Fingerprint: b2c4e91:docs/onboarding.md:generic-api-key:18
Secret: REDACTED
supports: a rule match in that commit
does not support: a live credential, or an owner