Gitleaks

Finds secrets in git history, files or stdin with regex, keyword and entropy rules.

Stars: ★ 29,825
License: MIT
Language: Go
Latest release: v8.30.1 · 21 Mar 2026
Last push: 30 Sept 2026
OpenSSF Scorecard: Not in the weekly scan

ghtier rating5/5 · Top pick

The default open-source secret scanner: one binary, no network, easy rules and baselines.

How it works

Gitleaks is a Go binary. For a repository it runs git log -p and scans each patch, so it sees secrets that were added and later deleted. It can also scan a plain directory or stdin.

Rules live in a TOML config: each has a regex, optional keywords that must appear first (a cheap pre-filter), an entropy threshold and allowlists. The default config covers a few hundred token formats. Known findings can be ignored with a baseline report, a .gitleaksignore file of fingerprints, or a gitleaks:allow comment.

Output is JSON, CSV, JUnit, SARIF or a custom template, with --redact to keep matches out of logs. The exit code is non-zero when anything is found.

What it catches

Cloud keys, GitHub tokens, Slack and Stripe tokens and other known formats
Private keys and generic high-entropy secrets
Secrets removed from HEAD but still in history
New secrets in a PR's commit range

Run it

brew install gitleaks
gitleaks detect --source . --redact
# only the commits in a PR:
gitleaks detect --source . --redact --log-opts="origin/main..HEAD"

What leaves your machine

Nothing. Scanning is local.

Limits

It does not check whether a secret is live; TruffleHog's verification does.
Custom token formats need your own rules.
The official gitleaks-action needs a free license key for organization accounts, which is why many workflows install the binary instead.

Related tools

Checkov★ 9.1k

Related incidents

UserJanuary 2024

Mercedes-Benz source code exposure

An employee committed a token to a public repo. It gave unrestricted and unmonitored access to the entire source code on the internal GitHub Enterprise Server, exposing database connection strings, cloud access keys, blueprints, design documents, SSO passwords, and API keys. The first token granted full ownership of the account; inside one of its private repos sat a second token to the GHE instance, a classic chained-credential blast radius that ran from the user plane straight into the enterprise plane.

Click to open →

ApplicationAugust 2024

ArtiPACKED artifact token leakage

actions/checkout persists the GitHub token into .git/config by default; uploading the whole checkout directory as an artifact exposes it. Researchers observed leakage of both GITHUB_TOKEN and the undocumented ACTIONS_RUNTIME_TOKEN, which lives about six hours and can be used to swap an artifact for a malicious version. The token-theft path is a race condition: download the artifact mid-run and create a branch before expiry. It requires the workflow to hold contents: write.