# Gitleaks

> Use for repository and filesystem secret discovery during authorized pentests. Trigger on code review, repository hygiene assessment, and validating whether credentials or tokens are exposed in approved source material.

- Skill: `timsonner/gitleaks` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/gitleaks`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/gitleaks/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/gitleaks

---


# Gitleaks

## Purpose

Use this skill to identify exposed secrets in approved repositories or source trees.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to review a repository or filesystem for exposed secrets.
- Need to validate source-control hygiene.
- Need a repeatable retest after secret cleanup.

## Avoid When

- The repository or filesystem is out of scope.
- Output would expose more secret material than necessary.

## Inputs

- Approved repository or directory path
- Output handling and redaction rules
- Scan depth aligned to the current question

## Procedure

1. Scope the scan to the approved repository or path.
2. Triage matches for real secrets versus false positives.
3. Minimize exposure of raw secret values in notes and reports.
4. Tie confirmed leaks to realistic impact and credential scope.
5. Preserve the exact scan path for retest.

## Command Syntax

Replace sample paths with approved in-scope repositories.

```bash
# Detect secrets in the current directory
gitleaks detect -s .

# Scan a local git repository with JSON report
gitleaks git /path/to/contoso-repo --report-path contoso-gitleaks.json --report-format json

# Scan only recent commits (last 50)
gitleaks git /path/to/contoso-repo --log-opts "HEAD~50..HEAD" --report-path contoso-gitleaks.json

# Scan staged files before commit
gitleaks detect --staged --source .

# Use custom rules configuration
gitleaks git /path/to/contoso-repo --config .gitleaks.toml
```

## Evidence to Capture

- Confirmed secret exposure and its repository context
- Whether the secret appears active or historical
- Exact scan path used during validation

## Safety Boundaries

- Redact or minimize raw secret material in evidence.
- Do not use exposed credentials beyond the explicit engagement scope.