Gitleaks — Find Secrets in Git Repos and Code

What it is

Gitleaks is a fast static application security testing (SAST) tool for detecting hardcoded secrets in Git repositories. It scans commit history and source code using regex patterns to find AWS keys, database passwords, API tokens, private keys, and other credentials that should never be committed.

Gitleaks is designed for security engineers and developers who want to prevent secret leaks before they reach production, integrated into CI/CD pipelines and pre-commit hooks.

How it saves time or tokens

Gitleaks scans entire Git histories in seconds, catching secrets that were committed and later deleted but still exist in history. Running it as a pre-commit hook prevents secrets from being committed in the first place. This avoids the costly process of rotating compromised credentials after a leak.

How to use

1. Install Gitleaks:

brew install gitleaks
# Or: go install github.com/gitleaks/gitleaks/v8@latest

1. Scan your repository:

# Scan all commits
gitleaks detect

# Scan only staged changes (pre-commit)
gitleaks protect --staged

# Scan a directory without Git
gitleaks dir -s ./src

1. Add as a pre-commit hook for continuous protection

Example

# Output results as JSON for CI integration
gitleaks detect --report-format json --report-path results.json

# Custom config for additional patterns
cat > .gitleaks.toml << 'EOF'
[[rules]]
id = 'custom-api-key'
description = 'Custom API Key'
regex = '''MYAPP_API_KEY=[a-zA-Z0-9]{32}'''
[rules.allowlist]
paths = ['test/', 'docs/']
EOF

gitleaks detect -c .gitleaks.toml

Related on TokRepo

• Security tools — security scanning and auditing resources
• DevOps tools — CI/CD pipeline integration tools

Common pitfalls

• Not scanning Git history (use detect not just dir), which misses secrets in deleted commits
• Generating too many false positives without configuring allowlists for test data
• Running Gitleaks only in CI without a pre-commit hook, allowing secrets to enter the repo first