Where Does detect-secrets Store Its Baseline?
detect-secrets tracks known findings in .secrets.baseline at the repo root, created by scan and enforced by the hook.
Last updated
detect-secrets splits three tools around one file. scan writes .secrets.baseline, audit labels its findings true or false positive, and the hook (or pre-commit entry) fails commits introducing anything not already baselined.
The baseline is a checklist, not absolution: it records what exists so only new secrets trip the wire. Slim baselines skip audit metadata for quieter diffs but cannot be audited later, so pick the flavor deliberately.
Where detect-secrets stores this, by platform
[RepoDir]\.secrets.baseline
Findings, plugin settings, audit labels. Wire the hook with args --baseline and exclude lockfiles; the slim variant trades auditability for diff quiet.
[RepoDir]/.secrets.baseline
Same file. Baseline encoding must stay UTF-8 or audit refuses it with a confusing validity error.
[RepoDir]/.secrets.baseline
Same layout. Entropy limits (--base64-limit/--hex-limit) and plugin toggles live in scan flags, baked into the baseline on creation.
Frequently asked questions
How do I update the baseline after changing code?
Run detect-secrets scan --baseline .secrets.baseline. It refreshes plugins, adds new findings and drops fixed ones while preserving your audit labels.
How do I excuse one false positive without rebuilding everything?
Add a pragma: allowlist secret comment (same line or nextline). It silences that finding without regenerating the file, and --only-allowlisted lists every exception for review.
Notice an outdated path? Let us know.