Static Code Analysis
Scan git history for hardcoded keys and tokens
Detect hardcoded secrets in git repos and plain directories.
overview
What gitleaks does
gitleaks scans a repository for hardcoded secrets: passwords, API keys, tokens, and similar credentials. It walks full commit history by default, so a key committed then deleted still surfaces. Rules are regex and entropy based; extend them with --config or --repo-config-path.
Automation knobs matter. --no-git treats the path as a plain directory. --log-opts bounds the commit range. --redact strips matched secrets from logs and stdout. Choose json, csv, or sarif with --report-format.
Slot it after repo recovery (for example gitjacker) or as a CI gate on a source folder. Prefer gitleaks for fast regex/entropy history scans; reach for trufflehog when you need live credential verification.
use cases
Where gitleaks fits
Find secrets across full git history
Scan a repository's entire commit history so a credential that was added and later removed is still caught and reported, not only what sits in the current tree.
Gate secrets before they merge
Run gitleaks against each branch or pull request in an automated workflow so a committed key blocks the merge instead of reaching production.
Recover-then-scan exposed repositories
Point gitleaks at a repo reconstructed from an exposed .git directory to triage which committed keys and tokens leaked.
Emit SARIF for unified triage
Set the report format to SARIF so secret findings join scanner output in one table and one reporting flow.
reference
gitleaks inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| source-git-repository | FOLDER | --source | Directory to scan. |
| config | FILE | --config | Config file path for custom detection rules. |
| report-format | STRING | --report-format | Output format: json, csv, or sarif (default json). |
| no-git | BOOLEAN | --no-git | Treat the git repo as a regular directory and scan those files. |
| redact | BOOLEAN | --redact | Redact secrets from logs and stdout. |
| log-options | STRING | --log-opts | git log options to bound the commit range scanned. |
| repo-config-path | FILE | --repo-config-path | Path to a gitleaks config relative to the repo root. |
| log-level | STRING | --log-level | Log level: trace, debug, info, warn, error, fatal (default info). |
Showing key inputs. gitleaks exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| source-git-repository | FOLDER | --source | Directory to scan. |
| config | FILE | --config | Config file path for a custom rule set. |
| no-git | BOOLEAN | --no-git | Treat the git repo as a regular directory and scan those files; --log-opts then has no effect on the scan. |
| redact | BOOLEAN | --redact | Redact secrets from logs and stdout. |
| verbose | BOOLEAN | --verbose | Show verbose output from the scan. |
| log-level | STRING | --log-level | Log level: trace, debug, info, warn, error, or fatal (default info). |
| log-options | STRING | --log-opts | git log options to bound the commit range scanned. |
| report-format | STRING | --report-format | Output format: json, csv, or sarif (default json). |
| repo-config-path | FILE | --repo-config-path | Path to a gitleaks config relative to the repo root. |
example
Run gitleaks
# scan a repo's full history, redact matches, emit SARIFgitleaks detect --source ./example-repo --config gitleaks.toml --report-format sarif --redactFinding: generic_api_key = REDACTEDSecret: REDACTEDRuleID: generic-api-keyFile: src/config/settings.pyLine: 42Commit: 9f3a1c2b7d4e5f60a1b2c3d4e5f6a7b8c9d0e1f2Author: ci-botDate: 2025-02-11T14:22:07ZFingerprint: 9f3a1c2b:src/config/settings.py:generic-api-key:423:22PM WRN leaks found: 2guidance
Choosing gitleaks
Use gitleaks when you have a git repo or code directory to check for committed secrets. Pair it upstream with a recovery tool like gitjacker; emit SARIF or JSON into your reporting path. Prefer trufflehog when verification of live credentials matters more than scan shape.
trufflehog
Also hunts secrets in git history; can verify whether a credential is still live.
noseyparker
Regex-based secret scanning across large code corpora.
semgrep
Broader static analysis: secret patterns plus other code and security rules.
faq
gitleaks questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
dawnscanner
Static review of Ruby source for security issues, CVEs, and OWASP risks.
Run gitleaks yourself
A source repository feeds gitleaks, which scans the working tree and history and writes the secret findings as a queryable output.
Facts on this page come from the live Trickest tool library.