- Home
- Secrets Scanning Software
- Gitleaks
Gitleaks
What it is
Gitleaks is free, MIT-licensed software for finding secrets such as passwords, API keys, and tokens in Git repositories, files, and data streamed through stdin. It runs on Linux, macOS, and Windows, and can also be self-hosted. Scans can cover repositories, directories, individual files, or standard input. Custom detection rules can combine Go regular expressions, entropy checks, path matching, keywords, and allowlists. A prior report can be used as a baseline so later scans report only new findings. Output options include JSON, CSV, JUnit, SARIF, and template formats. The project documents use as a pre-commit hook and GitHub Action, as well as CI/CD and pull-request scanning. Installation options include Homebrew, Docker, Go, and prebuilt release binaries. A redaction setting can mask secrets in logs and standard output, with a default redaction value of 100%. The project describes Gitleaks as feature complete, with future releases limited to security patches, and says only the latest version is supported. Its security policy requests private vulnerability reports through GitHub rather than public issues.
For and against
For
- Scans repositories, files, directories, and stdin.
- Custom rules support regex and allowlists.
- Baselines can limit reports to new findings.
- Reports include JSON, CSV, JUnit, and SARIF.
- Redaction defaults to 100%.
Against
- Future releases are limited to security patches.
- Only the latest version is supported.
The verdict
Gitleaks offers configurable secret scanning and several report formats, with documented pre-commit and GitHub Action use. The project says it is feature complete, so future releases are limited to security patches.
Who it suits
Gitleaks may suit developers and teams scanning repositories or files for exposed secrets, including in pre-commit and CI/CD workflows. Its latest-version-only support is relevant for teams planning maintenance.
Plans and prices
Gitleaks
MIT-licensed software · latest version supported
Read 2 Oct 2026 · github.com
On the record
- Baselines
- A report can be used as a baseline so subsequent scans report only new findings.github.com · read 2 Oct 2026
- Detection rules
- Users can configure custom detection rules using Go regular expressions, entropy checks, path matching, keywords, and allowlists.github.com · read 2 Oct 2026
- Installation
- The project documents installation through Homebrew, Docker, Go, and prebuilt release binaries.github.com · read 2 Oct 2026
- Integrations
- The project documents use as a pre-commit hook and as a GitHub Action.github.com · read 2 Oct 2026
- License
- The repository is distributed under the MIT License, which permits use, copying, modification, distribution, sublicensing, and sale subject to its terms.github.com · read 2 Oct 2026
- Maintenance status
- The project says it is feature complete and future releases will be security patches only.github.com · read 2 Oct 2026
- Purpose
- Gitleaks detects secrets such as passwords, API keys, and tokens in Git repositories, files, and stdin.github.com · read 2 Oct 2026
- Reports
- Gitleaks can output reports in JSON, CSV, JUnit, SARIF, or template format.github.com · read 2 Oct 2026
- Scan modes
- Gitleaks supports scanning Git repositories, directories or files, and data streamed through stdin.github.com · read 2 Oct 2026
- Secret handling
- The CLI has a redaction option that can redact secrets in logs and standard output, with a default redaction value of 100%.github.com · read 2 Oct 2026
- Security reporting
- The security policy asks users to report vulnerabilities privately through GitHub rather than opening a public issue.github.com · read 2 Oct 2026
- Support scope
- The security policy says only the latest version is supported.github.com · read 2 Oct 2026
