Gitleaks

Gitleaks is a command-line tool written in Go that scans git repositories, directories, files, or piped input for hardcoded secrets such as passwords, API keys, and tokens. It's built for developers and security teams who want to catch leaked credentials before they land in a commit history or before a repo becomes public. The maintainer has marked the project feature complete, meaning new development is shifting to a successor project called Betterleaks, but gitleaks still receives security patches and remains fully usable.

Key features

• Multiple scan modes: git for scanning commit history (via git log -p), dir for scanning files and directories, and stdin for streaming arbitrary input.
• Regex and entropy-based detection: rules combine Go regular expressions with Shannon entropy checks to reduce false positives on things like API keys and tokens.
• Custom rule configuration: define your own detection rules in TOML, extend the built-in default ruleset, or disable specific default rules.
• Allowlists: exclude findings by commit, file path, regex match, or stopword, with support for AND/OR conditions and multiple allowlists per rule.
• Baseline reports: generate a baseline from a prior scan so future scans only surface new findings, useful for large repos with long histories.
• Pre-commit hook support: block commits containing secrets locally, with an option to skip the check via SKIP=gitleaks.
• Multiple output formats: JSON, CSV, JUnit, SARIF, or custom templates for integrating with CI pipelines and other tooling.
• git log-opts passthrough: scan a specific commit range or apply any git log option supported upstream.

Ideal use cases

Gitleaks fits teams that want a lightweight, self-hosted secret scanner they can run locally, in CI, or as a pre-commit hook without sending code to a third-party service. It works well for auditing an existing repo's full commit history for leaked credentials, gating pull requests in CI/CD pipelines, and scanning arbitrary files or piped data (like build logs) for accidental secret exposure.

It's a good fit if you need custom detection rules for internal token formats, since the TOML config format lets you extend or override the default ruleset. It's also reasonable for one-off audits: point it at a directory or a git repo and get a report in JSON, CSV, SARIF, or another format.

It's not the right tool if you need active secret remediation, automatic revocation, or a managed SaaS dashboard, gitleaks only detects and reports, it doesn't rotate or invalidate exposed credentials. If you want ongoing feature development beyond security patches, the maintainer points to Betterleaks as the actively developed successor. Very large monorepos with deep histories may also need tuning (baselines, archive/decode depth limits) to keep scan times and noise manageable.

Installation

Install via Homebrew on macOS:

brew install gitleaks

Or pull the Docker image:

docker pull zricethezav/gitleaks:latest
docker run -v ${path_to_host_folder_to_scan}:/path zricethezav/gitleaks:latest [COMMAND] [OPTIONS] [SOURCE_PATH]

Or build from source (requires Go):

git clone https://github.com/gitleaks/gitleaks.git
cd gitleaks
make build

Prebuilt binaries for common platforms are available on the GitHub releases page.

To run gitleaks as a pre-commit hook, install pre-commit, add a .pre-commit-config.yaml referencing the gitleaks repo and a pinned version, then run:

pre-commit install

Basic usage looks like:

gitleaks git -v path_to_repo
gitleaks dir -v path_to_directory_or_file
cat some_file | gitleaks -v stdin

Custom configuration can be loaded via --config, the GITLEAKS_CONFIG environment variable, GITLEAKS_CONFIG_TOML, or a .gitleaks.toml file in the target path, in that order of precedence. If none are set, gitleaks falls back to its built-in default ruleset.