From 8d48c26c1eadc419dd6222d15aaf7f55fd0c5cb4 Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Mon, 20 Apr 2026 17:57:32 +0200
Subject: [PATCH] chore(secrets): don't block for trufflehog (#10806)

---
 .github/workflows/find-secrets.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/find-secrets.yml b/.github/workflows/find-secrets.yml
index 0aa955413f..88f84d6729 100644
--- a/.github/workflows/find-secrets.yml
+++ b/.github/workflows/find-secrets.yml
@@ -27,11 +27,12 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            ghcr.io:443
-            pkg-containers.githubusercontent.com:443
+          # We can't block as Trufflehog needs to verify secrets against vendors
+          egress-policy: audit
+          # allowed-endpoints: >
+          #   github.com:443
+          #   ghcr.io:443
+          #   pkg-containers.githubusercontent.com:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2