Add Betterleaks secret scanning to CI

[shubham-s-pandey]

Summary

Adds Betterleaks-based secret scanning to detect credentials that may be accidentally committed to pull requests or repository history. This is an additive security control.

Security impact

A leaked GitHub, Cloudflare, or OAuth credential could allow unauthorized
access to repositories, certificate-generation workflows, or deployment
resources. Detecting these values before merge reduces the time a credential
can remain exposed and gives maintainers an actionable CI failure.

What this PR adds

• config/betterleaks.toml

  • Uses Betterleaks' built-in detectors.
  • Filters documented placeholders to reduce false positives.

• .github/workflows/betterleaks.yml

  • Runs on pull requests and pushes to main.
  • Scans complete Git history.
  • Uses the public Betterleaks container.
  • Requires no API key or repository secret.
  • Mounts the checkout read-only.
  • Grants only contents: read.
  • Documents operation, local reproduction, findings handling, and upgrades.

Validation

• The custom Betterleaks configuration parses successfully.
• The workflow explicitly loads config/betterleaks.toml.
• Full repository history is available to the scanner.
• No real credentials or secret-like test values are committed.

[kingthorin]

Why?

[shubham-s-pandey]

@kingthorin The goal was to add Betterleaks as a secret-scanning check for CI. It is intended to detect accidental commits of credentials or tokens and fail the workflow before those changes are merged.

WSTG is a large, actively contributed repository, so an automated check provides a consistent safeguard across pull requests from different contributors. The workflow uses read-only permissions, requires no API keys, and scans the repository history with a pinned scanner version. This improves the repository’s overall security posture and helps maintain good security hygiene for both the project and its contributors.

[Copilot]

🟡 Changes recommended

The security check can be modified by the PR itself, and its scanner image is not pinned immutably.

3 open findings

• Run security scans from trusted workflow configuration · New
• Pin scanner image to an immutable digest · New
• Correct PR documentation to reference master branch · New

What changed in this PR

Adds Betterleaks secret scanning to CI using the repository configuration and full Git history.

Changes:

• Runs scans for pull requests, master pushes, and manual dispatches.
• Uses a read-only checkout and restricted permissions.
• Executes Betterleaks through its container image.

File	Description
.github/​workflows/​betterleaks.yml	Defines the Betterleaks CI workflow.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kingthorin]

Thanks for the idea but this has never been a problem for us. There are issues with the implementation and this came out of the blue.

[shubham-s-pandey]

@kingthorin I'll fix this issues. This is proactive security approach for CI.

[kingthorin]

It's okay, I'll consider some other/similar controls to implement by the team.

Thanks