Gitleaks
A tool for detecting secrets like passwords, API keys, and tokens in git repositories, directories, and stdin.
What is Gitleaks?
Gitleaks is a command-line tool that scans git repositories, directories, and data streams to detect hardcoded secrets like passwords, API keys, and tokens. It helps prevent accidental exposure of sensitive information in source code by identifying potential security leaks early in the development lifecycle.
Developers, DevOps engineers, and security teams who need to audit codebases for exposed secrets, especially those integrating security checks into CI/CD pipelines or pre-commit hooks.
Developers choose Gitleaks for its lightweight, regex-based detection engine, extensive customization options, and seamless integration into existing workflows via Docker, GitHub Actions, and pre-commit hooks.
Overview
Find secrets with Gitleaks 🔑
Use Cases
Best For
- Scanning git repositories for historical secrets in commit history
- Integrating secret detection into CI/CD pipelines via GitHub Actions
- Enforcing pre-commit hooks to prevent secrets from being committed
- Auditing directories and files for hardcoded credentials
- Customizing detection rules for organization-specific secret patterns
- Generating security audit reports in multiple output formats
Not Ideal For
- Projects requiring real-time, behavioral analysis of secrets beyond static code scanning
- Teams that prefer fully managed SaaS solutions with built-in dashboards and automated remediation
- Environments where secrets are obfuscated with custom encryption not detectable by regex or entropy
Pros & Cons
Pros
Supports scanning git repositories, directories/files, and stdin, enabling versatile use cases from historical audits to live data streams, as detailed in the commands section.
Uses TOML configuration for defining custom regex patterns, entropy checks, and keywords, allowing precise tuning to organization-specific secret types, with examples in the config documentation.
Can be integrated via CLI, Docker, GitHub Actions, and pre-commit hooks, with ready-to-use examples in the README for each method, facilitating easy adoption into existing workflows.
Includes composite rules for multi-part secrets, decoding of encoded text, and scanning within archive files, enhancing detection capabilities for hidden or obfuscated credentials.
Cons
The TOML-based configuration, especially with composite rules, multiple allowlists, and proximity settings, can be intricate and time-consuming to set up correctly without deep expertise.
Relies primarily on regex and entropy, which may miss novel or dynamically generated secrets and require constant rule updates, leading to potential false negatives or positives.
While it detects secrets effectively, Gitleaks does not provide automated tools to rotate, remove, or alert on exposed credentials, leaving remediation as a manual step.
Frequently Asked Questions
Related Projects
VaultA tool for secrets management, encryption as a service, and privileged access management
InfisicalInfisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
truffleHogFind, verify, and analyze leaked credentials
truffleHogFind, verify, and analyze leaked credentials
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.