Static Code Analysis
Hunt leaked secrets across GitHub orgs and URL responses
Scan GitHub orgs and URL responses for leaked secrets.
overview
What leakos does
leakos runs gitleaks and trufflehog against GitHub orgs, users, repos, and HTTP response bodies, then merges the findings. Scope with --github-orgs, --github-repos, --github-users, or feed --urls-file for response scanning.
Pass --github-token to cover org members and ease API limits. --only-verified keeps trufflehog-confirmed hits. Cap web work with --max-urls; extend patterns via --rex-regex-path. Skip an engine with --not-gitleaks or --not-trufflehog.
Use it when you need org-wide or response-wide secret hunting in one pass. For a single cloned repo history scan, run gitleaks or trufflehog alone. Trickest runs leakos as a managed node and writes FILE plus FOLDER output.
use cases
Where leakos fits
Scan a GitHub org for leaked API keys
Give leakos an org name with --github-orgs and a token so it checks the org's and its members' repositories for exposed keys and credentials in one run.
Find secrets in web responses
Feed a file of URLs with --urls-file so leakos scans each response body for leaked tokens, useful against a surface a crawler mapped moments ago.
Keep findings to verified only
Enable --only-verified so leakos returns trufflehog-confirmed secrets, cutting noise when you need actionable results from a large scan.
Monitor an org for new leaks
Schedule the leakos node so each run re-scans the org and its members, surfacing secrets that landed in a commit since the last pass.
Extend detection with custom regexes
Supply your own regex file with --rex-regex-path so leakos matches organization-specific token formats alongside the built-in gitleaks and trufflehog checks.
reference
leakos inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| github-orgs | STRING | --github-orgs | GitHub org names to search (comma separated). Members are searched too. |
| github-repos | STRING | --github-repos | GitHub repos to search (comma separated). |
| github-token | STRING | --github-token | Token to access the GitHub API (no permissions required). |
| urls-file | FILE | --urls-file | File of URLs whose responses are searched for leaks. |
| only-verified | BOOLEAN | --only-verified | Return only verified leaks (uses trufflehog). |
| rex-regexes | FILE | --rex-regex-path | Custom regexes file for the rex engine. |
| max-urls | STRING | --max-urls | Maximum number of URLs to check. |
| threads | STRING | --threads | Number of threads to use. |
Showing key inputs. leakos exposes 24 inputs in total.
Full flag reference (24 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| debug | BOOLEAN | --debug | Enable debug output. |
| not-rex | BOOLEAN | --not-rex | Do not run the rex regex checks. |
| threads | STRING | --threads | Number of threads to use. |
| timeout | STRING | --tools-timeout | Custom timeout while executing the underlying tools. |
| max-urls | STRING | --max-urls | Maximum number of URLs to check. |
| not-exts | STRING | --not-exts | Skip URLs with these extensions (comma separated). |
| urls-file | FILE | --urls-file | File of URLs whose responses are searched for leaks. |
| github-orgs | STRING | --github-orgs | GitHub org names to search (comma separated). Members are searched too. |
| rex-regexes | FILE | --rex-regex-path | Custom regexes file for the rex engine. |
| github-repos | STRING | --github-repos | GitHub repos to search (comma separated). |
| github-token | STRING | --github-token | Token to access the GitHub API (requires no permissions). |
| github-users | STRING | --github-users | GitHub user names to search (comma separated). |
| not-gitleaks | BOOLEAN | --not-gitleaks | Do not run the gitleaks checks. |
| avoid-sources | STRING | --avoid-sources | Lowercase comma-separated list of trufflehog and gitleaks sources to skip. |
| only-verified | BOOLEAN | --only-verified | Return only verified leaks (uses trufflehog). |
| not-trufflehog | BOOLEAN | --not-trufflehog | Do not run the trufflehog checks. |
| github-orgs-file | FILE | --github-orgs-file | File of GitHub org names to search. |
| github-repos-file | FILE | --github-repos-file | File of GitHub repos to search. |
| github-users-file | FILE | --github-users-file | File of GitHub user names to search. |
| max-secret-length | STRING | --max-secret-length | Maximum length of a valid secret. |
| add-org-repos-forks | BOOLEAN | --add-org-repos-forks | Check an org repo even if it is a fork. |
| generic-leak-in-web | BOOLEAN | --generic-leak-in-web | Accept generic leaks in web responses (disabled by default). |
| add-user-repos-forks | BOOLEAN | --add-user-repos-forks | Check a user repo even if it is a fork. |
| from-trufflehog-only-verified | BOOLEAN | --from-trufflehog-only-verified | From trufflehog, keep only verified leaks. |
example
Run leakos
# scan a GitHub org and its members for verified secretsleakos --github-orgs example-org --github-token $GITHUB_TOKEN --only-verified --threads 10[ {"source": "gitleaks", "repo": "example-org/payments-api", "file": "config/settings.py", "line": 42, "rule": "aws-access-token", "secret": "AKIA****************", "verified": false}, {"source": "trufflehog", "repo": "example-org/mobile-app", "file": ".env.staging", "line": 7, "rule": "SlackWebhook", "secret": "xoxb-****************", "verified": true}, {"source": "trufflehog", "url": "https://staging.example.com/static/app.js", "rule": "StripeApiKey", "secret": "sk_live_****************", "verified": true}, {"source": "gitleaks", "repo": "example-org/infra-scripts", "file": "deploy/backup.sh", "line": 15, "rule": "private-key", "secret": "-----BEGIN RSA PRIVATE KEY-----", "verified": false}]# 4 leaks (2 verified) across 3 repos and 1 URLguidance
Choosing leakos
Use leakos to sweep a GitHub org or a set of web responses for leaked secrets in one pass, since it wraps both gitleaks and trufflehog. For scanning a single cloned repository's history directly, use gitleaks or trufflehog on their own.
gitleaks
Secret scanner for git repos. leakos drives it across whole orgs and merges findings with trufflehog.
trufflehog
Verified-secret scanner. leakos uses it as one engine; run it alone for a single source.
noseyparker
Fast secret and regex matcher over large inputs. Alternate engine for the same secret-hunting job.
faq
leakos questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run leakos yourself
A GitHub org feeds leakos, which scans its repositories with gitleaks and trufflehog and writes the discovered secrets as a queryable output.
Facts on this page come from the live Trickest tool library.