Gitleaks
Detect hardcoded secrets like passwords and API keys in git repos.
Detect API keys, passwords, and tokens across git repositories, files, and standard input.
Gitleaks is a command-line tool designed to find leaked secrets in your source code history and file systems. It suits developers and security professionals who need to enforce credential safety in CI/CD pipelines or local workflows.
What it is
It parses git commit history using patch analysis, scans static directories, or processes data streamed via stdin. Using regex-based rules and entropy checking, it identifies patterns corresponding to sensitive keys and generates reports in formats like JSON, SARIF, or CSV.
Who it's for
It suits DevSecOps engineers and developers integrating security checks into git hooks or CI pipelines. It does not suit teams looking for active feature expansion, as the creator has marked the project feature-complete and shifted focus to Betterleaks.
Key features
Multiple Scan Modes
Scan local git repositories, individual files, directories, or data streamed via stdin.
Pre-Commit Integration
Catch hardcoded secrets locally before they ever touch remote repositories using pre-commit hooks.
Flexible Reporting
Output scan results in JSON, CSV, JUnit, SARIF, or customized template formats.
Baseline Management
Generate baseline ignore paths to manage existing issues in large or legacy codebases.
Up and running in 3 steps
Our honest verdict
What's great
- Scans past and present git history using log patches
- Integrates directly into pre-commit workflows and CI/CD pipelines
- Supports multiple output formats including SARIF and JSON
- Allows custom configurations and ignore paths via TOML files
Where it falls short
- Project is feature complete with no new feature merges planned
- May require tuning rules to reduce false positives depending on codebase
- Scanning massive repository histories requires manual baseline setup to handle existing noise
Pricing & license
Free under its open source license, with no paid hosted option provided by the repository. The only cost is running it yourself on your own hardware or CI runner.
Open remote AI-training roles
880 open remote AI-training roles, updated November 15, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
Is Gitleaks still actively maintained?
Gitleaks is in maintenance mode for security patches only, as the author has shifted focus to Betterleaks.
How can I skip Gitleaks during a git commit?
You can prepend `SKIP=gitleaks` to your git commit command to bypass the check locally.
