Run safeguard detect with the secrets type on the checked out tree, write JSON or SARIF, and leave redaction on. Detected values are redacted by default, which keeps the result file from becoming a second copy of the leaked secret. Treat any real hit as compromised and rotate it.
What detect does
The CLI documentation describes detect as the command that finds secrets and misconfigurations, with output as a table, JSON or SARIF. The usage page shows a type option with secrets as the example, a severity option, and a flag that controls redaction.
safeguard detect --detect secrets --path . --severity high --format json --output secrets.json
Other type values are not listed on the usage page. Run the help output for your version to see them.
Why redaction matters in CI
A pipeline artifact is readable by many people and often kept for weeks. If a scanner wrote the raw secret into it, the leak would spread to everyone with pipeline access. Redaction by default avoids that. The option to show values exists for local debugging. Do not use it in a pipeline.
What to do with a hit
First assume the secret is live and compromised. Removing the line from the file does not help, because the value is in history and possibly in forks and clones. Rotate it, then clean up history if you must.
GitHub's guidance applies in the same way inside CI: if an unredacted secret reaches a run log, delete the log and rotate the secret. Do both.
Where to run it
Run it on pull requests, so a secret is caught before merge. Running it only on the main branch finds secrets after they have already been published to the remote.
For the pipeline itself, keep your own secrets out of the YAML. GitLab's documentation advises keeping them out of the CI file, masking them, and limiting them to protected branches. Jenkins advises the credentials helper and single quoted shell strings. GitHub notes that anyone with write access can read the repository's secrets.
What detect will not catch
A scanner finds patterns. A secret with no recognisable shape, such as a long random password in a config file, may be missed. Pattern based tools also produce false positives, such as test keys. Triage with a person, and keep a short allowlist process.
Gating
Detect exits zero when it ran. To block on findings, use a platform gate or check the output file yourself, as in this gating post.
Tuning for noise
A secrets scan on a large repository will find test fixtures and example keys. Use the severity option to start with high findings only, fix those, then lower the bar. Document any allowed pattern with a reason and a date to review. An allowlist with no owner turns into a hole.
Quick check
The tool found a secret in an old commit. Is it fixed if I delete the file?
No. The value stays in history. Rotate it first.
Is redaction a security boundary?
It reduces accidental exposure. It does not stop someone with repository access from reading the original.
Sources
- Safeguard docs: CLI usage
- Safeguard docs: CLI
- GitHub docs: Security hardening for GitHub Actions
- GitLab docs: CI/CD variables
- Jenkins: Using a Jenkinsfile
Last reviewed: 19 October 2026.
