Gitleaks: find secrets that were committed to a Git repository

Gitleaks (about 30,000 stars on GitHub) is a secret scanner written in Go. Zachary Rice started it in 2018 and still leads the project, with a community of contributors maintaining the detection rules. The tool solves a problem every team meets sooner or later: a credential pasted into a config file, committed, and pushed, where it stays visible in history even after the file is edited. Gitleaks finds such strings before they leave a developer’s machine, or after the fact across an existing repository.

How it works

Gitleaks walks either the commits of a repository or the files of a directory and tests each line against a set of rules. Every rule combines a regular expression with the shape of a known credential (for example an AWS access key, a GitHub token, a Slack webhook or a PEM private key), an optional entropy threshold to catch generic high-randomness strings, and keywords that narrow where the rule is applied. Hits are printed with the file, line, commit and author, so the team knows exactly what to rotate. Findings that are false positives can be listed in a .gitleaksignore file or excluded through an allowlist in a .gitleaks.toml configuration, which can also add rules for your own internal token formats.

Who it is for

• Developers who want a check that stops them from committing a secret by mistake, usually through the pre-commit integration.
• Teams that add secret scanning to CI so that pull requests with leaked credentials are rejected automatically; the official gitleaks/gitleaks-action covers GitHub Actions.
• Administrators auditing an old repository before it is made public or handed over.
• Anyone who prefers a scanner that runs locally with no account and no server.

How to install and try it

brew install gitleaks
gitleaks version
gitleaks git --verbose .
gitleaks dir --verbose .

The git subcommand examines the full history of the repository in the current directory; the dir subcommand scans the files on disk and is the right choice for a project that is not under version control. Binaries are on the releases page, and a Docker image is published for CI environments. The README documents the configuration format and the pre-commit setup.

Credit

Gitleaks was created by Zachary Rice and is maintained by him and the contributors listed on GitHub. It is published under the MIT License.