diff --git a/.github/workflows/reusable-secrets.yml b/.github/workflows/reusable-secrets.yml
index 278bf62..7e67863 100644
--- a/.github/workflows/reusable-secrets.yml
+++ b/.github/workflows/reusable-secrets.yml
@@ -26,47 +26,86 @@ jobs:
 
       - name: Install Gitleaks
         run: |
+          set -euo pipefail
           GITLEAKS_VERSION="8.24.2"
           curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
           tar -xzf gitleaks.tar.gz gitleaks
           sudo mv gitleaks /usr/local/bin/gitleaks
           gitleaks version
 
-      - name: Run Gitleaks
-        id: gitleaks
+      - name: Ensure Gitleaks config exists
         run: |
-          mkdir -p reports
-          set +e
-          gitleaks detect --source . --report-format json --report-path reports/gitleaks-report.json --config "${{ inputs.config_path }}"
-          EXIT_CODE=$?
-          set -e
+          set -euo pipefail
+          CONFIG_PATH="${{ inputs.config_path }}"
 
-          if [ ! -f reports/gitleaks-report.json ]; then
-            echo '[]' > reports/gitleaks-report.json
-          fi
+          if [ ! -f "$CONFIG_PATH" ]; then
+            echo "Config file not found at $CONFIG_PATH. Creating a default Gitleaks config."
 
-          FINDINGS_COUNT=$(python - <<'PY'
-          import json
-          from pathlib import Path
-          path = Path('reports/gitleaks-report.json')
-          try:
-              data = json.loads(path.read_text())
-              print(len(data) if isinstance(data, list) else 0)
-          except Exception:
-              print(0)
-          PY
-          )
-                    echo "findings_count=${FINDINGS_COUNT}" >> "$GITHUB_OUTPUT"
-          
-                    if [ "${{ inputs.fail_on_findings }}" = "true" ] && [ "$FINDINGS_COUNT" -gt 0 ]; then
-                      echo "Gitleaks found ${FINDINGS_COUNT} potential secrets."
-                      exit 1
-                    fi
-          
-                    if [ "$EXIT_CODE" -ne 0 ] && [ "$FINDINGS_COUNT" -eq 0 ]; then
-                      echo "Gitleaks exited with code $EXIT_CODE but no findings were parsed."
-                      exit "$EXIT_CODE"
-                    fi
+            mkdir -p "$(dirname "$CONFIG_PATH")"
+
+            cat > "$CONFIG_PATH" <<'EOF'
+            title = "Default Gitleaks Config"
+            
+            [extend]
+            useDefault = true
+            
+            [allowlist]
+            description = "Global allowlist"
+            paths = [
+              '''(^|/)node_modules(/|$)''',
+              '''(^|/)dist(/|$)''',
+              '''(^|/)build(/|$)''',
+              '''(^|/)\.git(/|$)''',
+              '''(^|/)reports(/|$)'''
+            ]
+            EOF
+                      else
+                        echo "Using existing Gitleaks config at $CONFIG_PATH"
+                      fi
+            
+                  - name: Run Gitleaks
+                    id: gitleaks
+                    run: |
+                      set -euo pipefail
+                      mkdir -p reports
+            
+                      set +e
+                      gitleaks detect \
+                        --source . \
+                        --report-format json \
+                        --report-path reports/gitleaks-report.json \
+                        --config "${{ inputs.config_path }}"
+                      EXIT_CODE=$?
+                      set -e
+            
+                      if [ ! -f reports/gitleaks-report.json ]; then
+                        echo '[]' > reports/gitleaks-report.json
+                      fi
+            
+                      FINDINGS_COUNT=$(python - <<'PY'
+                      import json
+                      from pathlib import Path
+            
+                      path = Path("reports/gitleaks-report.json")
+                      try:
+                          data = json.loads(path.read_text())
+                          print(len(data) if isinstance(data, list) else 0)
+                      except Exception:
+                          print(0)
+                      PY
+                      )
+            
+                      echo "findings_count=${FINDINGS_COUNT}" >> "$GITHUB_OUTPUT"
+            
+                      if [ "${{ inputs.fail_on_findings }}" = "true" ] && [ "$FINDINGS_COUNT" -gt 0 ]; then
+                        echo "Gitleaks found ${FINDINGS_COUNT} potential secrets."
+                        exit 1
+                      fi
+            
+                      if [ "$EXIT_CODE" -ne 0 ] && [ "$FINDINGS_COUNT" -eq 0 ]; then
+                        echo "Gitleaks exited with code $EXIT_CODE but no findings were parsed."
+                        exit "$EXIT_CODE"
+                      fi
 
       - name: Upload Gitleaks report
         if: always()