diff --git a/.github/workflows/.gitkeep b/.github/workflows/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/.github/workflows/secret-scanner.yaml b/.github/workflows/secret-scanner.yaml
new file mode 100644
index 0000000..81d1346
--- /dev/null
+++ b/.github/workflows/secret-scanner.yaml
@@ -0,0 +1,16 @@
+name: "Secret Scanner"
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+  id-token: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  secrets-scanner:
+    uses: arbor-education/gha.workflows/.github/workflows/secret-scanner-template.yaml@v1
+    secrets:
+      JIRA_SA_CREATE_ISSUE: ${{ secrets.JIRA_SA_CREATE_ISSUE }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..0b410b7
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,22 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.2.0
+    hooks:
+      - id: check-merge-conflict
+      - id: trailing-whitespace
+        exclude: '\.github/actions/.*/dist/.*'
+      - id: end-of-file-fixer
+        exclude: '\.github/actions/.*/dist/.*'
+      - id: check-json
+      - id: check-added-large-files
+      - id: check-yaml
+
+  - repo: local
+    hooks:
+      - id: trufflehog
+        name: TruffleHog
+        description: Detect secrets using TruffleHog.
+        entry: bash -c 'if ! command -v trufflehog &>/dev/null; then echo "ERROR: trufflehog is not installed."; echo "Install it via: curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin"; exit 1; fi; trufflehog git file://. --since-commit HEAD --results=verified --fail --no-update'
+        language: system
+        pass_filenames: false
+        stages: ["pre-commit", "pre-push"]