How do I scan a git repo for passwords and API keys?

Point the node's --source at the repository. The default rule set matches common passwords, API keys, and tokens across every commit, and you pick the output shape with --report-format. To check a directory that is not a git repo, add --no-git.

Can I use custom rules or cut down false positives?

Yes. Pass a custom rule file with --config, or commit one in the repo and point --repo-config-path at it. To suppress a known-good match such as a sample generic-api-key value, add an allowlist to that config or a .gitleaksignore fingerprint entry upstream.

What report formats does gitleaks support?

JSON, CSV, and SARIF, selected with --report-format (JSON is the default). SARIF lets the findings flow into the same code-scanning and triage tooling you use for other static analysis results.

How is gitleaks different from trufflehog?

Both hunt secrets in git history. gitleaks leans on fast regex and entropy rules over commits, while trufflehog can verify whether a found credential is still live. For a side-by-side, see the secret-scanning entries in the glossary; on Trickest you can also chain both in one workflow.

Is gitleaks written in Python? How do I install it?

No, gitleaks is a single Go binary, distributed through Homebrew, Docker, and GitHub releases; the pip or PyPI package you may find is a third-party wrapper, not the official build. On Trickest you do not install anything, the node runs the binary for you.

Why did my Trickest gitleaks node finish with no saved output?

gitleaks exits with a non-zero code when it finds leaks, which can stop a node before its results are written. Set the leaks-exit-code to 0, as the node notes, so the findings file and folder are saved even when secrets are detected.

Updated Jul 14, 2026

Static Code Analysis

Find hardcoded secrets across a git repo's full history

Detect hardcoded secrets like passwords, API keys, and tokens in git repos.

Find secrets across full git history Gate secrets before they merge Recover-then-scan exposed repositories

overview

What gitleaks does

gitleaks scans a git repository for hardcoded secrets: passwords, API keys, tokens, and other credentials left in the code. It walks the full commit history as well as the working tree, so a key that was committed and later deleted still surfaces. Detection runs on a configurable set of regex and entropy rules that you can extend with your own config.

It was built to slot into automation. A no-git mode treats the repo as a plain directory and scans the files as they sit on disk, log options bound the commit range you walk, and a redact flag strips matched secrets from logs and stdout so the report itself does not leak. When a project ships its own rules, point repo-config-path at the config committed inside the repo.

On Trickest, gitleaks is a Static Code Analysis node that reads a source directory or config and writes a file and a folder of findings. Pick JSON, CSV, or SARIF for the report so secret findings land in the same triage and reporting path as the rest of your security automation.

source github.com/zricethezav/gitleaks

use cases

Where gitleaks fits

Find secrets across full git history

Scan a repository's entire commit history so a credential that was added and later removed is still caught and reported, not only what sits in the current tree.

Gate secrets before they merge

Run gitleaks against each branch or pull request in an automated workflow so a committed key blocks the merge instead of reaching production.

Recover-then-scan exposed repositories

Point gitleaks at a repo reconstructed from an exposed .git directory to triage which committed keys and tokens leaked.

Emit SARIF for unified triage

Set the report format to SARIF so secret findings join scanner output in one table and one reporting flow.

reference

gitleaks inputs and flags

9 inputs

Name	Type	Flag	Description
source-git-repository	FOLDER	--source	Directory to scan.
config	FILE	--config	Config file path for custom detection rules.
report-format	STRING	--report-format	Output format: json, csv, or sarif (default json).
no-git	BOOLEAN	--no-git	Treat the git repo as a regular directory and scan those files.
redact	BOOLEAN	--redact	Redact secrets from logs and stdout.
log-options	STRING	--log-opts	git log options to bound the commit range scanned.
repo-config-path	FILE	--repo-config-path	Path to a gitleaks config relative to the repo root.
log-level	STRING	--log-level	Log level: trace, debug, info, warn, error, fatal (default info).

Showing key inputs. gitleaks exposes 9 inputs in total.

Full flag reference (9 inputs)

Name	Type	Flag	Description
source-git-repository	FOLDER	--source	Directory to scan.
config	FILE	--config	Config file path for a custom rule set.
no-git	BOOLEAN	--no-git	Treat the git repo as a regular directory and scan those files; --log-opts then has no effect on the scan.
redact	BOOLEAN	--redact	Redact secrets from logs and stdout.
verbose	BOOLEAN	--verbose	Show verbose output from the scan.
log-level	STRING	--log-level	Log level: trace, debug, info, warn, error, or fatal (default info).
log-options	STRING	--log-opts	git log options to bound the commit range scanned.
report-format	STRING	--report-format	Output format: json, csv, or sarif (default json).
repo-config-path	FILE	--repo-config-path	Path to a gitleaks config relative to the repo root.

example

Run gitleaks

gitleaks · command

# scan a repo's full history, redact matches, emit SARIFgitleaks detect --source ./example-repo --config gitleaks.toml --report-format sarif --redact

sample output

Finding:     generic_api_key = REDACTEDSecret:      REDACTEDRuleID:      generic-api-keyFile:        src/config/settings.pyLine:        42Commit:      9f3a1c2b7d4e5f60a1b2c3d4e5f6a7b8c9d0e1f2Author:      ci-botDate:        2025-02-11T14:22:07ZFingerprint: 9f3a1c2b:src/config/settings.py:generic-api-key:423:22PM WRN leaks found: 2

guidance

Choosing gitleaks

Use gitleaks whenever you have a git repository or a directory of code to check for committed secrets. It scans source, not a running target, so pair it with a recovery tool like gitjacker upstream and route its SARIF or JSON into your reporting flow.

trufflehog

Also hunts secrets in git history, with verification of live credentials; a close alternative.

noseyparker

Fast regex-based secret scanning across large code corpora.

semgrep

Broader static analysis; finds secret patterns plus other code-quality and security issues.

faq

gitleaks questions

It walks the full git history by default, so secrets that were added and later removed are still found. Use --log-opts to bound the commit range and --no-git to scan the files as a plain directory instead of reading history.

Run gitleaks yourself

A source repository feeds gitleaks, which scans the working tree and history and writes the secret findings as a queryable output.

Run gitleaks in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

source-git-repository

FOLDER

--source

Directory to scan.

config

FILE

--config

Config file path for custom detection rules.

report-format

STRING

--report-format

Output format: json, csv, or sarif (default json).

no-git

BOOLEAN

--no-git

Treat the git repo as a regular directory and scan those files.

redact

BOOLEAN

--redact

Redact secrets from logs and stdout.

log-options

STRING

--log-opts

git log options to bound the commit range scanned.

repo-config-path

FILE

--repo-config-path

Path to a gitleaks config relative to the repo root.

log-level

STRING

--log-level

Log level: trace, debug, info, warn, error, fatal (default info).

Name

Type

Flag

Description

source-git-repository

FOLDER

--source

Directory to scan.

config

FILE

--config

Config file path for a custom rule set.

no-git

BOOLEAN

--no-git

Treat the git repo as a regular directory and scan those files; --log-opts then has no effect on the scan.

redact

BOOLEAN

--redact

Redact secrets from logs and stdout.

verbose

BOOLEAN

--verbose

Show verbose output from the scan.

log-level

STRING

--log-level

Log level: trace, debug, info, warn, error, or fatal (default info).

log-options

STRING

--log-opts

git log options to bound the commit range scanned.

report-format

STRING

--report-format

Output format: json, csv, or sarif (default json).

repo-config-path

FILE

--repo-config-path

Path to a gitleaks config relative to the repo root.

Finding: generic_api_key = REDACTEDSecret: REDACTEDRuleID: generic-api-keyFile: src/config/settings.pyLine: 42Commit: 9f3a1c2b7d4e5f60a1b2c3d4e5f6a7b8c9d0e1f2Author: ci-botDate: 2025-02-11T14:22:07ZFingerprint: 9f3a1c2b:src/config/settings.py:generic-api-key:423:22PM WRN leaks found: 2

Find hardcoded secrets across a git repo's full history

What gitleaks does

Where gitleaks fits

Find secrets across full git history

Gate secrets before they merge

Recover-then-scan exposed repositories

Emit SARIF for unified triage

gitleaks inputs and flags

Run gitleaks

Choosing gitleaks

trufflehog

noseyparker

semgrep

gitleaks questions

More Static Code Analysis tools

bandit

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gosec

Run gitleaks yourself

Find hardcoded secrets across a git repo's full history

What gitleaks does

Where gitleaks fits

Find secrets across full git history

Gate secrets before they merge

Recover-then-scan exposed repositories

Emit SARIF for unified triage

gitleaks inputs and flags

Run gitleaks

Choosing gitleaks

trufflehog

noseyparker

semgrep

gitleaks questions

More Static Code Analysis tools

bandit

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gosec

Run gitleaks yourself