Gitleaks

gitleaks Plugin

Find secrets with Gitleaks. Detect secrets, credentials, and sensitive information in git repositories, files, and directories. Supports custom rules, baselines, and CI/CD integration.

Commands

Secret Detection

• gitleaks repo detect — Detect secrets in git repository
• gitleaks repo protect — Protect git repository from secrets
• gitleaks baseline generate — Generate baseline for known secrets

Utility

• gitleaks _ _ — Passthrough to gitleaks CLI

Usage Examples

• "Scan this repository for secrets"
• "Protect git commits from leaking secrets"
• "Check for credentials in this directory"
• "Generate a baseline for known secrets"

Installation

brew install gitleaks

Or via Go:

go install github.com/gitleaks/gitleaks/v8/cmd/gitleaks@latest

Examples

# Detect secrets in current repository
gitleaks repo detect --source .

# Detect secrets with custom config
gitleaks repo detect --source . --config gitleaks-config.toml

# Generate JSON report
gitleaks repo detect --source . --report results.json --report-format json

# Generate SARIF report for CI/CD
gitleaks repo detect --source . --report results.sarif --report-format sarif

# Verbose output
gitleaks repo detect --source . --verbose

# Redact secrets from output
gitleaks repo detect --source . --redact

# Scan without git history
gitleaks repo detect --source . --no-git

# Protect staged commits
gitleaks repo protect --staged

# Generate baseline
gitleaks baseline generate --source . --baseline .gitleaks-baseline.json

# Scan with baseline
gitleaks repo detect --source . --baseline .gitleaks-baseline.json

# Any gitleaks command with passthrough
gitleaks _ _ detect --source . --verbose
gitleaks _ _ protect --staged

Key Features

• Secret detection — Find API keys, passwords, tokens
• Git history scanning — Scan entire git repository history
• File scanning — Scan individual files or directories
• Custom rules — Define custom secret detection rules
• Baseline support — Ignore known/secrets
• Multiple formats — JSON, SARIF, CSV output
• CI/CD integration — GitHub Actions, pre-commit hooks
• Redaction — Redact secrets from output
• Configurable — Custom configuration files
• Fast scanning — Efficient scanning algorithms

Notes

• Default scans entire git history
• Use --no-git for directory-only scanning
• Baseline files allow ignoring known secrets
• Can be used as pre-commit hook
• Supports GitHub Actions natively
• Exit codes indicate if secrets were found