Max Issues + Gitleaks Collector

✓ Guardrail ↓ Collector Beta Security And Compliance

Enforce Max Issues using data collected by Gitleaks Collector. Automatically check security and compliance standards on every PR.

Guardrail: Ensures the number of secret findings is under a configurable threshold. Use this for gradual remediation of existing codebases.

Data Source: Detects hardcoded secrets using Gitleaks in two modes: auto-runs scans on every repo, and detects existing Gitleaks executions in CI pipelines to collect their report files. Results are written to the normalized .secrets Component JSON category.

Get Started View on GitHub

How Gitleaks Collector Powers This Guardrail

The Gitleaks Collector gathers metadata from your security systems. This data flows into Lunar's Component JSON, where the Max Issues guardrail evaluates it against your standards.

When enabled, this check runs automatically on every PR and in AI coding workflows, providing real-time enforcement with actionable feedback.

↓ Gitleaks Collector Gathers Data Collector

Extracts metadata from code, configs, and tool outputs

{ } Component JSON

Data centralized in structured format for evaluation

✓ Max Issues Checks Guardrail

Pass/fail result with actionable feedback in PRs

Quick Start Configuration

Add both the collector and policy to your lunar-config.yml to enable this guardrail.

📄 lunar-config.yml

# Step 1: Enable the Gitleaks Collector
collectors:
  - uses: github://earthly/lunar-lib/collectors/gitleaks@v1.0.5
    # with: ...

# Step 2: Enable the Secrets Guardrails
policies:
  - uses: github://earthly/lunar-lib/policies/secrets@v1.0.5
    include: [max-issues]
    # with: ...

What Gitleaks Collector Collects

This collector gathers the following data that the Max Issues guardrail evaluates.

Collector code

`scan`

Auto-runs Gitleaks against the repository source code. Parses the JSON report and writes normalized findings to .secrets with source metadata.

Collector ci-after-command

`cicd`

Detects Gitleaks execution in CI pipelines. Records command metadata to .native.gitleaks.cicd.cmds and collects the JSON report file if --report-path / -r can be parsed from the command. Collected reports are written to .secrets.cicd (normalized) and .native.gitleaks.cicd.report (raw).

Example Data Flow

Here's an example of the data that Gitleaks Collector writes to the Component JSON, which Max Issues then evaluates.

{ } component.json From Gitleaks Collector

{
  "secrets": {
    "source": {
      "tool": "gitleaks",
      "version": "8.21.2",
      "integration": "code"
    },
    "issues": [
      {
        "rule": "generic-api-key",
        "file": "config/settings.py",
        "line": 42,
        "secret_type": "Generic API Key"
      }
    ],
    "cicd": [
      {
        "rule": "aws-access-key-id",
        "file": "deploy.sh",
        "line": 10,
        "secret_type": "AWS Access Key ID"
      }
    ],
    "native": {
      "gitleaks": {
        "auto": {
          "report": [
            {
              "RuleID": "generic-api-key",
              "File": "config/settings.py",
              "StartLine": 42,
              "Commit": "abc1234",
              "Description": "Generic API Key"
            }
          ]
        },
        "cicd": {
          "cmds": [
            {"cmd": "gitleaks detect --report-path results.json --source .", "version": "8.21.2"}
          ],
          "report": [
            {
              "RuleID": "aws-access-key-id",
              "File": "deploy.sh",
              "StartLine": 10,
              "Commit": "def5678",
              "Description": "AWS Access Key ID"
            }
          ]
        }
      }
    }
  }
}

Configuration Options

Secrets Guardrails Inputs

Input	Required	Default	Description
`max_issues_threshold`	Required	—	Maximum number of secret issues allowed (must be configured)

Learn More

Guardrail · Secrets Guardrails Max Issues View all compatible integrations

→

Collector Gitleaks Collector View full documentation

→

Ready to Automate Your Standards?

See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 100+ built-in guardrails.

Works with any process

AI agent rules & prompt files

Post-mortem action items

Security & compliance policies

Testing & quality requirements

Automate Now

Paste your AGENTS.md or manual process doc and get guardrails in minutes

Book a Demo