Skip to content
Deepak Gupta markRecon Atlas

Code and secret leaks

Gitleaks

Regex-based secrets scanner for auditing your own git history, directories and piped input, with pre-commit and CI support.

PassiveScope a pentestAudit your own exposure

31k stars · last push October 28, 2026 · v8.30.1 · MIT

GitHub repository

What it finds

Gitleaks scans your local git repositories (through git log -p patches), directories and stdin for passwords, API keys and tokens. Detection uses configurable regex rules with optional entropy thresholds and keywords. Baselines suppress known findings, and optional decoding and archive traversal widen coverage.

  • secrets
  • passwords
  • API keys
  • tokens

Does it touch the target?

Reads third-party sources only. Sends no traffic to the target's systems.

README: "The git command lets you scan local git repos. Under the hood, gitleaks uses the git log -p command to scan patches." Modes are git, dir and stdin; the README describes no verification calls to credential providers.

API keys: The CLI README documents no API keys; gitleaks.io separately says the Gitleaks-Action GitHub Action needs a free license key for organisation accounts.

Install

Install with brew
brew install gitleaks

From the project's documentation

Install with docker
docker pull zricethezav/gitleaks:latest
docker run -v ${path_to_host_folder_to_scan}:/path zricethezav/gitleaks:latest [COMMAND] [OPTIONS] [SOURCE_PATH]

From the project's documentation

Install with source
git clone https://github.com/gitleaks/gitleaks.git
cd gitleaks
make build

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Scan the git repo in the current directory, verbose
gitleaks git -v

From the project's documentation

Scan a directory or file
gitleaks dir -v path_to_directory_or_file

From the project's documentation

Save a report to use as a baseline
gitleaks git --report-path gitleaks-report.json

From the project's documentation

Report only findings not in the baseline
gitleaks git --baseline-path gitleaks-report.json --report-path findings.json

From the project's documentation

Output formats: json, csv, junit, sarif, template

Limits the project documents

  • README warning: Gitleaks is feature complete and future releases will be security patches only; the maintainer is shifting focus to Betterleaks.
  • Rule regexes use Go's engine, which does not support lookaheads.
  • Decoding of encoded text (--max-decode-depth) and archive scanning (--max-archive-depth) are off by default (depth 0).
  • The detect and protect commands were deprecated in v8.19.0 and are hidden from --help.

Deepak's take

Analysis, not documentation

Use it when
Use it as a fast pre-commit hook or CI step on your own repositories, with a baseline so only new leaks fail the build.
Skip it when
Skip it when you need to know whether a found credential is still live, or need to scan cloud buckets and images; TruffleHog covers both.
What it will miss
It flags only strings matching its rules, and does not report whether a found secret still works.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: MIT. Gitleaks is a trademark or project name of its owners; this library is not affiliated with it.