How to Monitor Gitleaks with Vigilmon

Gitleaks scans Git repositories and CI/CD pipelines for hardcoded secrets — API keys, tokens, passwords, and credentials accidentally committed to source control. When Gitleaks itself is running correctly, it's a quiet guardian. But when the webhook that receives scan results goes down, when the Gitleaks API server you've built around it becomes unreachable, or when the notification service that pages your security team stops working, secret leak events are silently swallowed. Vigilmon gives you external monitoring of the infrastructure surrounding your Gitleaks deployment — scan result receivers, reporting dashboards, and notification pipelines — so you know when your secret scanning coverage has a gap.

What You'll Build

• A health monitor on your Gitleaks scan result receiver or webhook endpoint
• A monitor on any Gitleaks reporting API or dashboard you've deployed
• An alerting check on notification pipelines (Slack webhooks, PagerDuty endpoints) that Gitleaks fires on detection
• SSL certificate monitoring for all endpoints in your Gitleaks pipeline
• An alerting setup tuned to the sensitivity of a security scanning tool

Prerequisites

• A Gitleaks deployment scanning repositories or CI/CD pipelines (any version)
• An HTTP-accessible scan result receiver, reporting API, or dashboard
• A free account at vigilmon.online

Step 1: Understand What to Monitor in a Gitleaks Deployment

Gitleaks is a CLI tool and a GitHub Action — it runs, scans, and exits with a non-zero code on findings. The infrastructure around it that can silently fail:

• Scan result receivers: A webhook or API that collects Gitleaks SARIF or JSON reports from CI/CD pipelines
• Reporting dashboards: A service your security team uses to review findings across repos
• Notification endpoints: Slack webhooks, PagerDuty integration endpoints, or email gateways that Gitleaks triggers on a secret detection
• Gitleaks API server (if using Gitleaks Enterprise or a custom wrapper): an HTTP server managing scan policies and report aggregation

When any of these fail, secret scan events are dropped without trace.

Step 2: Monitor Your Scan Result Receiver

If your CI/CD pipelines POST Gitleaks reports to a central receiver, monitor its health endpoint:

curl https://security.example.com/gitleaks/health

Your receiver should expose a health route:

# FastAPI example
@app.get("/gitleaks/health")
def health():
    return {"status": "ok", "receiver": "gitleaks"}

@app.post("/gitleaks/report")
def receive_report(report: dict):
    # store report, trigger alerts, update dashboard
    return {"received": True}

Configure your CI/CD pipeline to POST the report:

# GitHub Actions
- name: Run Gitleaks
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Upload report
  if: always()
  run: |
    curl -s -X POST https://security.example.com/gitleaks/report \
      -H "Content-Type: application/json" \
      -d @gitleaks-report.json

Add a Vigilmon monitor for the receiver:

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://security.example.com/gitleaks/health.
3. Check interval: 2 minutes.
4. Response timeout: 10 seconds.
5. Expected status: 200.
6. Keyword: "status":"ok".
7. Label: Gitleaks scan receiver.
8. Click Save.

Alert after: 1 failure. A downed receiver means secret leak events are silently dropped from your CI pipelines.

Step 3: Monitor Your Gitleaks Reporting Dashboard

If you've deployed a dashboard (Grafana, a custom service, or a SaaS integration) for reviewing Gitleaks findings across your organization, monitor its availability:

curl -I https://security-dashboard.example.com/gitleaks

Add a Vigilmon monitor:

1. Add Monitor → HTTP.
2. URL: https://security-dashboard.example.com/gitleaks.
3. Check interval: 5 minutes.
4. Expected status: 200.
5. Label: Gitleaks reporting dashboard.
6. Click Save.

Step 4: Monitor Notification Endpoints

Gitleaks fires alerts to Slack, PagerDuty, or other notification services when it detects a secret. If these notification endpoints are down, your security team won't be paged for active leaks.

Slack webhook health check: Slack incoming webhooks return 405 Method Not Allowed on GET (the expected behavior — the endpoint exists and is reachable):

1. Add Monitor → HTTP.
2. URL: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX.
3. Check interval: 5 minutes.
4. Expected status: 405 (Slack returns 405 on GET — 404 means the webhook is deleted).
5. Label: Gitleaks Slack webhook.
6. Click Save.

PagerDuty Events API health:

curl https://events.pagerduty.com/v2/enqueue

Returns 400 Bad Request on a bare GET (no payload) — which confirms the endpoint is reachable:

1. Add Monitor → HTTP.
2. URL: https://events.pagerduty.com/v2/enqueue.
3. Check interval: 5 minutes.
4. Expected status: 400 (expected for a GET with no body — confirms reachability).
5. Label: PagerDuty Events API (Gitleaks).
6. Click Save.

Step 5: Monitor a Custom Gitleaks Policy API

If you've built a service to manage Gitleaks .gitleaks.toml policy files centrally and distribute them to pipelines, monitor its health:

curl https://policy.example.com/api/gitleaks/health

Policy API response:

{
  "status": "ok",
  "rules_loaded": 147,
  "last_updated": "2026-07-03T00:00:00Z"
}

Add a monitor:

1. Add Monitor → HTTP.
2. URL: https://policy.example.com/api/gitleaks/health.
3. Check interval: 5 minutes.
4. Expected status: 200.
5. Keyword: "status":"ok".
6. Label: Gitleaks policy API.
7. Click Save.

Policy staleness check: The last_updated field tells you when rules were last refreshed. A stale policy means new secret patterns added to the rule set aren't being enforced. Consider adding a secondary monitor or alerting job that checks this timestamp against a maximum age.

Step 6: Monitor SSL Certificates

All endpoints in your Gitleaks pipeline (scan receiver, dashboard, policy API) must have valid TLS certificates. An expired certificate causes CI pipeline steps that POST to your receiver to fail with TLS handshake errors — silently dropping scan results:

1. Add Monitor → SSL Certificate.
2. Domain: security.example.com.
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days, 1 day.
5. Click Save.

Repeat for each domain in your Gitleaks pipeline: security-dashboard.example.com, policy.example.com.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Scan receiver | Non-200 or keyword missing | Restart receiver service; check for unhandled exceptions in logs | | Reporting dashboard | Non-200 | Check dashboard service; verify database connectivity | | Slack webhook | 404 (not 405) | Webhook was deleted; re-create and update pipeline config | | PagerDuty Events API | Non-400/non-200 | Check PagerDuty status; verify integration key is valid | | Policy API | Non-200 or stale | Refresh policy rules; check rule source connectivity | | SSL certificates | < 30 days to expiry | Renew certificate; check ACME automation |

Alert routing: Route scan receiver and notification endpoint alerts to your security team immediately — these affect active threat detection coverage. Route dashboard and policy API alerts to your DevSecOps team.

Common Gitleaks Pipeline Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Scan receiver down — reports silently dropped | Receiver monitor fires; security team has no visibility into CI scan results | | Slack webhook deleted — no alerts for secret detections | Webhook monitor returns 404 instead of 405 | | PagerDuty integration broken | Events API monitor shows unexpected status | | Dashboard unavailable — team can't review findings | Dashboard monitor fires | | Policy API stale — new secret patterns not enforced | Policy API staleness check detects old last_updated timestamp | | TLS cert expired on receiver — CI POST fails silently | SSL monitor alerts at 30-day threshold |

Gitleaks protects your codebase from credential leaks — but only if the infrastructure surrounding it is healthy. A downed scan receiver, a deleted Slack webhook, or an expired TLS certificate can silently break your entire secret scanning pipeline without triggering a single alert. Vigilmon closes that gap with external monitoring of every endpoint in your Gitleaks workflow, so your security coverage remains complete even when individual services fail.

Start monitoring your Gitleaks pipeline in under 5 minutes — register free at vigilmon.online.