DevSecOps in Practice: Tools That Actually Catch Vulnerabilities - Part 1

A demo Flask app with embedded secrets showed how Gitleaks can block commits with pre-commit hooks.

Exceptions can be managed with .gitleaksignore when a secret is intentional or needs temporary allowlisting.

A GitHub Actions workflow adds CI scanning on pushes and pull requests as a safety net if hooks are bypassed.

The approach helps stop AWS keys, GitHub tokens, and API tokens from ever reaching git history or public repos.