From 806e49bcbf073e0b5c9229cef31d42855233b6c8 Mon Sep 17 00:00:00 2001
From: Rudy Celekli <rudy@gradiahq.com>
Date: Sun, 18 Oct 2026 09:20:29 -0400
Subject: [PATCH] fix(secrets): pass GITHUB_TOKEN to the gitleaks PR scan

---
 security/security-secrets-credential-engineer.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/security-secrets-credential-engineer.md b/security/security-secrets-credential-engineer.md
index 31b915f0..f2ce43a7 100644
--- a/security/security-secrets-credential-engineer.md
+++ b/security/security-secrets-credential-engineer.md
@@ -82,7 +82,9 @@ jobs:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }   # full history so an old leak is caught too
       - uses: gitleaks/gitleaks-action@v2
-        env: { GITLEAKS_CONFIG: .gitleaks.toml }  # allowlist known-public test fixtures
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # required by the action to scan pull_request events
+          GITLEAKS_CONFIG: .gitleaks.toml            # allowlist known-public test fixtures
 ```
 
 ### Static Key → Dynamic, Short-Lived Credential