diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 7c07816e..915748f5 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -11,6 +11,18 @@ on:
 
 jobs:
 
+  scan:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+
   build-test:
     name: Build & run UI Tests (${{ matrix.os }}, node-${{ matrix.node-version }})
     timeout-minutes: 60
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
new file mode 100644
index 00000000..ccf34040
--- /dev/null
+++ b/.vscode/tasks.json
@@ -0,0 +1,27 @@
+{
+    // See https://go.microsoft.com/fwlink/?LinkId=733558
+    // for the documentation about the tasks.json format
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "gitleaks",
+            "type": "shell",
+            "command": "docker run -v ${PWD}:/path gitleaks:latest dir /path -v --no-color | awk 'BEGIN { ORS=\"\" } /^Finding:/     {if (NR>1) print \"\\n\"; printf \"FINDING=%s|||\", substr($0, index($0,$2)) } /^Secret:/ {printf \"SECRET=%s|||\", $2} /^RuleID:/ {printf \"RULEID=%s|||\", $2} /^Entropy:/ {printf \"ENTROPY=%s|||\", $2} /^File:/ {printf \"FILE=%s|||\", $2} /^Line:/ {printf \"LINE=%s|||\", $2} /^Fingerprint:/ {printf \"FINGERPRINT=%s|||\", $2}'",
+            "problemMatcher": {
+                "source": "gitleaks",
+                "owner": "gitleaks",
+                "fileLocation": [
+                    "relative", "${workspaceFolder}"
+                ],
+                "pattern": [
+                    {
+                        "regexp": "^FINDING=(.*?)[|]{3}SECRET=(.*?)[|]{3}RULEID=(.*?)[|]{3}ENTROPY=(.*?)[|]{3}FILE=\/path\/(.+)[|]{3}LINE=(.*?)[|]{3}FINGERPRINT=(.*?)[|]{3}$",
+                        "file": 5,
+                        "line": 6,
+                        "message": 1
+                    }
+                ]
+            }
+        }
+    ]
+}
\ No newline at end of file
diff --git a/test-gitleaks.txt b/test-gitleaks.txt
new file mode 100644
index 00000000..636826bb
--- /dev/null
+++ b/test-gitleaks.txt
@@ -0,0 +1,16 @@
+This is a test - the following secret is fake
+
+setup the following secret as an environment variable:
+
+export SUPER_DUPER_SECRET="wibC7fyqq1"
+
+BTW, looking for a good password? Here are a few!
+
+"`_]TN)/+T`jp?19", "kW6hh*vu6wcF3g;", "gRoJ6ibcVv[zp}D", "8?JRgr}Kx-V('$aN-Ml_&"x%5CL)?<", "v9w1cRg4PUIVDyrSN63UTXkCgQRnxT5C"
+
+
+
+one more secret!
+
+ghp_ypwNi08kJx9H3YblGrkNFfqGaxat7d3cMPen
+