Skip to content
Get packs

Gitleaks

Open-source command-line tool that scans git repos and files for leaked passwords, API keys, and tokens.

GitHub Download v8.30.1
Stars
30.6k
Forks
2.3k
Licence
MIT
Language
Go
Last update
9 days ago
Type
CLI

What it is

Gitleaks is a command-line tool that searches code for secrets such as passwords, API keys, and tokens. It can scan git repositories (including their commit history), regular directories and files, or any text piped in through stdin. People use it to catch credentials before or after they are committed, often in pre-commit hooks or CI pipelines. The README notes that the project is feature complete and will only receive security patches, with the maintainer shifting focus to Betterleaks.

  • Scan a local repository's full git history with gitleaks git
  • Scan a folder or set of files with gitleaks dir
  • Pipe a file or output into gitleaks stdin to check it for secrets
  • Run it as a pre-commit hook so commits containing secrets fail
  • Write reports in json, csv, junit, or sarif format for other tools

Great for

  • Developers who want to catch accidentally committed credentials before they reach a shared repository
  • Teams adding a secret-scanning step to CI pipelines
  • Security staff auditing the history of existing git repositories
  • Anyone who wants a pre-commit hook that blocks commits containing secrets

Not ideal for

  • Users who need new features: the README says the project is feature complete and only security patches will be released
  • Users wanting a graphical interface: the README documents only command-line usage
  • Those expecting a guaranteed zero-false-positive result: the README does not make accuracy claims, and detection is regex-based
Step-by-step guide: how to use GitleaksInstall, first run, examples, tips and FAQs
fscan vs Gitleaks

How to get it

  1. 1

    Install with a package manager

    You'll need: Homebrew (macOS) or Docker, or Go for building from source

    Install with Homebrew (macOS)

    brew install gitleaks

    Pull the Docker image

    docker pull zricethezav/gitleaks:latest

    Clone the source

    git clone https://github.com/gitleaks/gitleaks.git

    Build from source

    make build
  2. 2

    Run it

    • Install gitleaks using one of the methods in the README
    • Change into a git repository you want to check
    • Run gitleaks git -v to scan the repository history
    • Review any findings listed, which include file, line, and commit
    • Optionally add a .pre-commit-config.yaml so the check runs on every commit
  3. 3

    Get the most out of it

    • Use --report-format and --report-path to save results as json, csv, junit, or sarif
    • Add a .gitleaks.toml config file, or set GITLEAKS_CONFIG, to customize rules
    • Create a baseline with --baseline-path to ignore findings you have already reviewed
    • Use --enable-rule to limit scans to specific rule IDs
    • Use --log-opts to scan a specific commit range

Downloads

Source code (.zip)master branch · straight from GitHubRelease v8.30.18 files incl. gitleaks_8.30.1_linux_armv7.tar.gzOfficial website & docsgitleaks.io

Strengths

  • Covers git history, files, and stdin in one tool
  • Installable through Homebrew, Docker, Go, or prebuilt binaries
  • Configurable with its own rules, baseline files, and ignore files

Trade-offs

  • Feature complete, so no new features are planned and only security patches will follow
  • Command-line only, so it requires comfort with a terminal
  • Detection relies on patterns, so results may need review and tuning

How it compares

ProjectStarsTypeLevelUpdatedBest for
gitleaks (this)30.6kCLIbeginner9 days agoDevelopers who want to catch accidentally committed credentials before they reach a shared repository
cli46.8kCLIbeginner6 days agoDevelopers who already work in the terminal and use GitHub daily
web-check35.3kAppintermediate4 days agoDevelopers checking how a site is configured
fscan14.7kCLIintermediate1 months agoSecurity staff running authorized internal network assessments
awesome-hacker-search-engines11.5kCurated listbeginner4 days agoSecurity professionals starting a penetration test or vulnerability assessment who need a place to look up data
gitea58.8kAppintermediate4 days agoTeams that want to host their own code instead of using a public cloud service

Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.