diff --git a/.woodpecker/gitleaks.yml b/.woodpecker/gitleaks.yml
new file mode 100644
index 0000000..c9af421
--- /dev/null
+++ b/.woodpecker/gitleaks.yml
@@ -0,0 +1,12 @@
+---
+when:
+  - event: "push"
+    branch: "main"
+  - event: "manual"
+
+steps:
+  - name: "gitleaks"
+    # renovate: datasource=github-releases depName=gitleaks/gitleaks
+    image: "cr.simoncor.net/ghcr/gitleaks/gitleaks:v8.30.1"
+    commands:
+      - "gitleaks detect --source . --verbose --redact"