diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
new file mode 100644
index 000000000..e3a83894d
--- /dev/null
+++ b/.github/workflows/gitleaks.yml
@@ -0,0 +1,21 @@
+name: gitleaks
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  scan:
+    name: gitleaks
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - uses: gitleaks/gitleaks-action@83373cf2f8c4db6e24b41c1a9b086bb9619e9cd3 # v2.3.7
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}
+          GITLEAKS_ENABLE_COMMENTS: false
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
+          GITLEAKS_ENABLE_SUMMARY: false
diff --git a/.gitleaks.toml b/.gitleaks.toml
index 487e5b19a..7bc03bbdf 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -5,9 +5,15 @@ useDefault = true
 
 [allowlist]
 paths = [
+  '''node_modules\/''',
   '''vendor\/''',
   '''(.*?)\.rptlibrary''',
+  '''package\.json''',
+  '''package-lock\.json''',
   '''pnpm-lock\.yaml''',
+  '''composer\.json''',
+  '''composer\.lock''',
+  '''yarn\.lock''',
   '''\.gitleaks\.toml$''',
   '''(.*?)(jpg|gif|doc|pdf|bin)$'''
 ]
@@ -15,5 +21,5 @@ paths = [
 regexTarget = "match"
 regexes = [
   '''ABCDEFG1234567890''',
-  '''s\.aBCD123DEF456GHI789JKL012'''
+  '''s.aBCD123DEF456GHI789JKL012'''
 ]