diff --git a/.github/workflows/pull-gitleaks.yaml b/.github/workflows/pull-gitleaks.yaml
new file mode 100644
index 000000000..089afebe5
--- /dev/null
+++ b/.github/workflows/pull-gitleaks.yaml
@@ -0,0 +1,23 @@
+name: pull-gitleaks
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+
+env:
+  GITLEAKS_VERSION: 8.18.2
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Fetch gitleaks ${{ env.GITLEAKS_VERSION }}
+        run: curl -Lso gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v${{ env.GITLEAKS_VERSION }}/gitleaks_${{ env.GITLEAKS_VERSION }}_linux_x64.tar.gz && tar -xvzf ./gitleaks.tar.gz
+      - name: Run gitleaks
+        # Scan commits between base and head of the pull request
+        run: ./gitleaks detect --log-opts=${PULL_BASE_SHA}...${PULL_HEAD_SHA} --verbose --redact
+        env: 
+          PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PULL_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
\ No newline at end of file