From 6b682dc3925f7b05029dae7ef96531108659e0f9 Mon Sep 17 00:00:00 2001
From: James Reeve <james.reeve@ibm.com>
Date: Tue, 15 Sep 2026 00:42:15 -0400
Subject: [PATCH] Add detect-secrets scanning (SKILLS-131558)

---
 .pre-commit-config.yaml |   6 ++
 .secrets.baseline       | 134 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 140 insertions(+)
 create mode 100644 .pre-commit-config.yaml
 create mode 100644 .secrets.baseline

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..83a2311
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,6 @@
+repos:
+  - repo: https://github.com/ibm/detect-secrets
+    rev: master
+    hooks:
+      - id: detect-secrets
+        args: ['--baseline', '.secrets.baseline', '--use-all-plugins', '--fail-on-unaudited']
diff --git a/.secrets.baseline b/.secrets.baseline
new file mode 100644
index 0000000..8adec15
--- /dev/null
+++ b/.secrets.baseline
@@ -0,0 +1,134 @@
+{
+  "exclude": {
+    "files": "(^|/)(package-lock\\.json|yarn\\.lock|pnpm-lock\\.yaml|Pipfile\\.lock|poetry\\.lock|Gemfile\\.lock|composer\\.lock)$|^.secrets.baseline$",
+    "lines": null
+  },
+  "generated_at": "2026-09-15T04:41:33Z",
+  "plugins_used": [
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "base64_limit": 4.5,
+      "name": "Base64HighEntropyString"
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "BoxDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "ghe_instance": "github.ibm.com",
+      "name": "GheDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "hex_limit": 3,
+      "name": "HexHighEntropyString"
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "keyword_exclude": null,
+      "name": "KeywordDetector"
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "results": {
+    ".github/workflows/rspec-tests.yml": [
+      {
+        "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 73,
+        "type": "Basic Auth Credentials",
+        "verified_result": null
+      }
+    ],
+    "docker-compose.yml": [
+      {
+        "hashed_secret": "2725d373c8751c3647bd53748e5f1d74cad70992",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 6,
+        "type": "Secret Keyword",
+        "verified_result": null
+      }
+    ],
+    "spec/dummy/config/database.yml": [
+      {
+        "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 23,
+        "type": "Basic Auth Credentials",
+        "verified_result": null
+      },
+      {
+        "hashed_secret": "e727d1464ae12436e899a726da5b2f11d8381b26",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 68,
+        "type": "Basic Auth Credentials",
+        "verified_result": null
+      }
+    ],
+    "spec/spec_helper.rb": [
+      {
+        "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 13,
+        "type": "Basic Auth Credentials",
+        "verified_result": null
+      }
+    ]
+  },
+  "version": "0.13.1+ibm.64.dss",
+  "word_list": {
+    "file": null,
+    "hash": null
+  }
+}