The original title is: "The .gitleaks-baseline.json That Suppressed Live Production Secrets"

Short summary

A real-world security incident where a gitleaks baseline file silently suppressed live production secrets (Garage rpc_secret and admin_token) committed to a public repository. The baseline workflow correctly identified the secrets but treated them as known-inert, allowing them to remain unrotated for months. The issue was caught during a manual audit of the baseline file, and the article walks through the full rotation process via Vault and Kubernetes ExternalSecret resync.

• •Gitleaks baseline files can suppress real, unrotated production secrets if generated at the wrong time
• •Manual baseline audits are essential — verify each suppressed finding has actually been rotated
• •Full remediation: rotate via Vault, force ExternalSecret resync, restart affected deployments

Generated with AI, which can make mistakes.