Gitleaks
Find secrets with Gitleaks 🔑
Last verified:
What is Gitleaks?
Gitleaks is an open-source (MIT licensed) secret scanner designed to detect secrets like passwords, API keys, and tokens in git repositories, files, directories, and stdin. It is the most trusted open source secret scanner among security professionals, enterprises, and developers, with over 20 million docker downloads, 19k GitHub stars, 14 million GitHub downloads, thousands of weekly clones, and over 850k homebrew installs. The tool is maintained by Zach Rice.
Key features include scanning for committed and uncommitted secrets, support for three scanning modes (git, dir, and stdin), custom rules via TOML configuration, multiple report formats (JSON, CSV, JUnit, SARIF, template), pre-commit hook integration, GitHub Action support via Gitleaks-Action, baseline functionality for ignoring old findings, decoding support for percent/hex/base64 encoded secrets, and archive scanning for zip/tar files. It uses regex and entropy-based detection to identify secrets.
Gitleaks is ideal for developers who want to shift security left and prevent secrets from being committed, DevOps teams integrating secret scanning into CI/CD pipelines, security professionals auditing repository history for exposed credentials, and enterprises needing organization-wide secret scanning. The Gitleaks-Action GitHub Action automatically runs scans on pull requests and commits.
Gitleaks pricing
Pricing model: Freemium
Gitleaks is completely free and open source under the MIT license. There is no paid tier or per-developer pricing. Gitleaks-Action is free for all use. If scanning repos belonging to a GitHub personal account, no license key is required. If scanning repos belonging to a GitHub organization account, you must obtain a free organization license key by filling out a Google Form. This contrasts with alternatives like GitGuardian and GitHub Advanced Security which charge per developer.
Gitleaks pros
- Completely free and open source with MIT license
- 19k GitHub stars and 20 million+ docker downloads proving trust
- Scans git repositories, directories, files, and stdin
- Three scanning modes: git, dir, and stdin
- Pre-commit hook integration stops secrets before commit
- Gitleaks-Action GitHub Action for automated PR/commit scanning
- Custom detection rules via TOML configuration file
- Multiple report formats: JSON, CSV, JUnit, SARIF, template
- Entropy-based detection reduces false positives
- Scan entire git history including past commits
- Baseline feature ignores old findings in subsequent scans
- Decoding support for percent, hex, and base64 encoded secrets
- Archive scanning extracts and scans zip/tar files
- gitleaks:allow comment bypasses specific secrets
- .gitleaksignore file ignores specific findings by fingerprint
- Gitleaks Playground for testing configs in browser
- No server uploads - Playground processes locally via WebAssembly
Gitleaks cons
- Single maintainer (Zach Rice) creates bus factor risk
- Requires separate installation unless using Docker
- Needs extra tool like pre-commit for git hooks management
- No built-in push protection like GitHub Advanced Security
- Must manually add false positives to allowlist
- Command-line interface may intimidate non-technical users
- No commercial enterprise support plan officially offered
- Archive and decoding features disabled by default
- Gitleaks-action requires free license key for GitHub organizations
- URL fragments for Playground sharing can be very long
- No graphical user interface for configuration
- Golang regex engine does not support lookaheads
- Experimental .gitleaksignore feature may change
- No native SaaS offering - must self-host
- Limited to Git repositories, not other version control systems
Frequently asked questions about Gitleaks
What is Gitleaks and what does it do?
Gitleaks is an open-source secret scanner for git repositories, files, directories, and stdin. It detects secrets like passwords, API keys, and tokens that may have been accidentally committed to code. It uses regex and entropy-based detection to find hardcoded secrets in your codebase, whether committed or uncommitted.
Is Gitleaks free to use?
Yes, Gitleaks is completely free and open source under the MIT license. There is no paid tier or per-developer pricing. The only requirement is that GitHub organization accounts need to obtain a free license key by filling out a Google Form, while personal accounts require no license.
How do I install Gitleaks?
Gitleaks can be installed using Homebrew (brew install gitleaks for macOS), Docker (docker pull zricethezav/gitleaks:latest), or from source (git clone and make build). Binary releases are available for many platforms on the GitHub releases page. You can also use it as a pre-commit hook or GitHub Action.
What scanning modes does Gitleaks support?
Gitleaks supports three scanning modes: git (scans local git repos using git log -p), dir (scans directories and files, also accessible via files or directory aliases), and stdin (streams data to Gitleaks for scanning). Each mode is invoked with commands like 'gitleaks git', 'gitleaks dir', or 'gitleaks stdin'.
Can I create custom detection rules?
Yes, Gitleaks allows custom rules via TOML configuration files. You can define rules with unique IDs, descriptions, regex patterns, secret groups, entropy thresholds, paths, keywords, tags, and allowlists. The configuration order of precedence is: --config flag, GITLEAKS_CONFIG env var, GITLEAKS_CONFIG_TOML env var, then .gitleaks.toml in target path.
How do I integrate Gitleaks into CI/CD?
Use the official Gitleaks-Action GitHub Action to automatically run scans on all pull requests and commits. The action requires GITHUB_TOKEN and optionally GITLEAKS_LICENSE for organizations. You can also run Gitleaks in your CI pipeline with commands like 'gitleaks git --report-format sarif --report-path gitleaks.sarif' for GitHub Security tab integration.
What report formats does Gitleaks support?
Gitleaks has built-in support for JSON, CSV, JUnit, and SARIF report formats. If none fit your needs, you can create custom formats using a Go text/template .tmpl file with the --report-template flag. The template can use functionality from the Masterminds/sprig template library.
How do I ignore false positives?
You can ignore false positives in three ways: add a 'gitleaks:allow' comment to the specific line, create a .gitleaksignore file with fingerprints of findings to ignore, or configure allowlists in your TOML config with commits, paths, regexes, or stopwords. The .gitleaksignore feature is experimental and may change.
Can Gitleaks scan encoded or archived secrets?
Yes, Gitleaks supports decoding for percent-encoded, hex-encoded (>=32 chars), and base64-encoded (>=16 chars) text using the --max-decode-depth flag. It also supports archive scanning for zip/tar files using --max-archive-depth to extract and scan contents. Both features are disabled by default (depth 0).
What is the Gitleaks Playground?
The Gitleaks Playground is a browser-based tool for testing Gitleaks configurations. It processes everything locally in your browser via WebAssembly with no server uploads or analytics collection. It includes a share feature using URL fragments (zlib compressed then base64 encoded), a rule wizard for generating new rules, and an entropy calculator. Never paste real secrets into the playground.