A tool for detecting secrets like passwords, API keys, and tokens in git repositories, directories, and stdin.
Gitleaks is a command-line tool that scans git repositories, directories, and data streams to detect hardcoded secrets like passwords, API keys, and tokens. It helps prevent accidental exposure of sensitive information in source code by identifying potential security leaks early in the development lifecycle.
Developers, DevOps engineers, and security teams who need to audit codebases for exposed secrets, especially those integrating security checks into CI/CD pipelines or pre-commit hooks.
Developers choose Gitleaks for its lightweight, regex-based detection engine, extensive customization options, and seamless integration into existing workflows via Docker, GitHub Actions, and pre-commit hooks.
Find secrets with Gitleaks 🔑
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports scanning git repositories, directories/files, and stdin, enabling versatile use cases from historical audits to live data streams, as detailed in the commands section.
Uses TOML configuration for defining custom regex patterns, entropy checks, and keywords, allowing precise tuning to organization-specific secret types, with examples in the config documentation.
Can be integrated via CLI, Docker, GitHub Actions, and pre-commit hooks, with ready-to-use examples in the README for each method, facilitating easy adoption into existing workflows.
Includes composite rules for multi-part secrets, decoding of encoded text, and scanning within archive files, enhancing detection capabilities for hidden or obfuscated credentials.
The TOML-based configuration, especially with composite rules, multiple allowlists, and proximity settings, can be intricate and time-consuming to set up correctly without deep expertise.
Relies primarily on regex and entropy, which may miss novel or dynamically generated secrets and require constant rule updates, leading to potential false negatives or positives.
While it detects secrets effectively, Gitleaks does not provide automated tools to rotate, remove, or alert on exposed credentials, leaving remediation as a manual step.