loading
Loading content
loading
Static Code Analysis
Detect hardcoded secrets in git repos and plain directories.
overview
gitleaks scans a repository for hardcoded secrets: passwords, API keys, tokens, and similar credentials. It walks full commit history by default, so a key committed then deleted still surfaces. Rules are regex and entropy based; extend them with --config or --repo-config-path.
Automation knobs matter. --no-git treats the path as a plain directory. --log-opts bounds the commit range. --redact strips matched secrets from logs and stdout. Choose json, csv, or sarif with --report-format.
Slot it after repo recovery (for example gitjacker) or as a CI gate on a source folder. Prefer gitleaks for fast regex/entropy history scans; reach for trufflehog when you need live credential verification.
use cases
Scan a repository's entire commit history so a credential that was added and later removed is still caught and reported, not only what sits in the current tree.
Run gitleaks against each branch or pull request in an automated workflow so a committed key blocks the merge instead of reaching production.
Point gitleaks at a repo reconstructed from an exposed .git directory to triage which committed keys and tokens leaked.
Set the report format to SARIF so secret findings join scanner output in one table and one reporting flow.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| source-git-repository | FOLDER | --source | Directory to scan. |
| config | FILE | --config | Config file path for custom detection rules. |
| report-format | STRING | --report-format | Output format: json, csv, or sarif (default json). |
| no-git | BOOLEAN | --no-git | Treat the git repo as a regular directory and scan those files. |
| redact | BOOLEAN | --redact | Redact secrets from logs and stdout. |
| log-options | STRING | --log-opts | git log options to bound the commit range scanned. |
| repo-config-path | FILE | --repo-config-path | Path to a gitleaks config relative to the repo root. |
| log-level | STRING | --log-level | Log level: trace, debug, info, warn, error, fatal (default info). |
Showing key inputs. gitleaks exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| source-git-repository | FOLDER | --source | Directory to scan. |
| config | FILE | --config | Config file path for a custom rule set. |
| no-git | BOOLEAN | --no-git | Treat the git repo as a regular directory and scan those files; --log-opts then has no effect on the scan. |
| redact | BOOLEAN | --redact | Redact secrets from logs and stdout. |
| verbose | BOOLEAN | --verbose | Show verbose output from the scan. |
| log-level | STRING | --log-level | Log level: trace, debug, info, warn, error, or fatal (default info). |
| log-options | STRING | --log-opts | git log options to bound the commit range scanned. |
| report-format | STRING | --report-format | Output format: json, csv, or sarif (default json). |
| repo-config-path | FILE | --repo-config-path | Path to a gitleaks config relative to the repo root. |
example
# scan a repo's full history, redact matches, emit SARIFgitleaks detect --source ./example-repo --config gitleaks.toml --report-format sarif --redactFinding: generic_api_key = REDACTEDSecret: REDACTEDRuleID: generic-api-keyFile: src/config/settings.pyLine: 42Commit: 9f3a1c2b7d4e5f60a1b2c3d4e5f6a7b8c9d0e1f2Author: ci-botDate: 2025-02-11T14:22:07ZFingerprint: 9f3a1c2b:src/config/settings.py:generic-api-key:423:22PM WRN leaks found: 2guidance
Use gitleaks when you have a git repo or code directory to check for committed secrets. Pair it upstream with a recovery tool like gitjacker; emit SARIF or JSON into your reporting path. Prefer trufflehog when verification of live credentials matters more than scan shape.
Also hunts secrets in git history; can verify whether a credential is still live.
Regex-based secret scanning across large code corpora.
Broader static analysis: secret patterns plus other code and security rules.
faq
related
AST-based security checks for Python source.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
Static review of Ruby source for security issues, CVEs, and OWASP risks.
A source repository feeds gitleaks, which scans the working tree and history and writes the secret findings as a queryable output.
Facts on this page come from the live Trickest tool library.