Gitleaks looks for credentials in code and in Git history. It is a single binary, which makes it easy to put in the one place it matters most: before the commit.

Why history matters

Removing a secret in a later commit does not remove it. It stays in history, retrievable by anyone who clones the repository, and if the repository was ever public it should be assumed compromised.

# Scan the working directory
gitleaks detect --source . --no-git

# Scan the full history, which is the one people forget
gitleaks detect --source .

# Scan staged changes only
gitleaks protect --staged

That last command is the important one.

Pre-commit is where the value is

Detection after the fact tells you to rotate a credential. Detection before the commit means there is nothing to rotate.

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

The cost of a pre-commit hook is a second per commit. The cost of a leaked production key is considerably more.

What it detects

Built-in rules cover the common formats: AWS keys, GitHub tokens, Stripe keys, private keys, JWTs, database connection strings, and many others. Rules combine pattern matching with entropy checks to catch high-randomness strings that look like credentials without matching a known format.

Custom rules can be added in a .gitleaks.toml for anything specific to your environment.

False positives

Test fixtures, example configuration, and documentation frequently contain things shaped like credentials.

[allowlist]
paths = [
  '''test/fixtures/.*''',
  '''docs/examples/.*''',
]

Keeping the allowlist tight matters. A broad allowlist eventually excludes the real thing.

If a secret already leaked

Rotate first. Removing it from history is secondary and does not undo the exposure, because anyone who cloned already has it.

Then clean history with git filter-repo or BFG, and force push, understanding that this rewrites history for every collaborator.

Related

Infisical includes secret scanning alongside a full secrets management platform, if you want both. Gitleaks is the standalone tool if you only want the scanning.

License

Gitleaks is released under the MIT License.

Links

• Website
• Repository