Gitleaks is a fast secrets scanner for Git repositories, filesystems, and CI/CD pipelines. It detects hardcoded secrets including API keys, tokens, passwords, and private keys using a library of regex-based rules. It can scan full commit history, staged changes, or arbitrary file paths, and is well-suited to both point-in-time assessments and pipeline integration.

• Scans Git repositories including full commit history
• Detects 150+ secret types including AWS, Azure, GCP, GitHub, Slack, and more
• Scans local directories, remote repos, and CI/CD pipeline output
• Configurable via TOML — rules can be added, suppressed, or tuned
• Outputs to JSON, CSV, and SARIF

No setup required. Run from the shell.

gitleaks detect --source <path-to-repo>
gitleaks detect --source .                          # current directory
gitleaks detect --source . --report-format json \
    --report-path /output/gitleaks-results.json

gitleaks detect --source . --no-git

gitleaks detect --source . --log-opts="main..HEAD"
gitleaks detect --source . --log-opts="--since=2024-01-01"

gitleaks detect --source https://github.com/<org>/<repo>

gitleaks detect --source <path> --no-git

gitleaks detect --source . \
    --report-format json \
    --report-path /output/gitleaks.json

gitleaks detect --source . \
    --report-format sarif \
    --report-path /output/gitleaks.sarif

gitleaks detect --source . \
    --report-format csv \
    --report-path /output/gitleaks.csv

Add a .gitleaksignore file to the repo root, or use the --baseline-path flag to suppress findings from a previous baseline scan:

# Create a baseline from current findings
gitleaks detect --source . --report-format json \
    --report-path baseline.json

# Future scans only report new findings
gitleaks detect --source . \
    --baseline-path baseline.json

Gitleaks exits non-zero if secrets are found, which is useful in CI/CD:

gitleaks detect --source . && echo "Clean" || echo "Secrets found"

• Scanning very large repositories with long histories can be slow. Use --log-opts to scope to a date range or commit range if needed.
• Some rules produce false positives on test fixtures or example files. Use .gitleaksignore or a custom config to suppress known FPs.

• GitHub Repo