What problem it solves

Passwords, API keys, and tokens can be committed or stored unnoticed in source code and repository history. Developers need a way to scan repositories, directories, individual files, and streamed data to identify these secrets.

Key features

• Multiple scanning modes — Scan local Git repositories, directories or files, and data supplied through standard input using the `git`, `dir`, and `stdin` commands.

  Source: README

• Configurable detection rules — Define secret detection rules with regular expressions, entropy thresholds, keywords, path patterns, and allowlists. Configurations can extend the default rules or replace them.

  Source: README, config

• Findings and reports — Findings include details such as the secret, rule, location, entropy, and fingerprint. Reports can be written in JSON, CSV, JUnit, SARIF, or a custom template format.

  Source: README, report

• Repository integrations — Run Gitleaks locally as a pre-commit hook or use the associated GitHub Action. Installation options include Homebrew, Docker, Go, and release binaries.

  Source: README, .pre-commit-hooks.yaml

• Encoded content and archives — Optionally decode supported encoded text and scan the contents of nested archives. Both capabilities have configurable depth limits and are disabled by default.

  Source: README

Who it may suit

This project may suit developers, security teams, and maintainers who need to check repositories, source trees, or streamed content for exposed credentials.

Topics to discuss

• Which secret-detection rules and allowlist patterns should be included in the default configuration?

• How can baseline workflows be improved for repositories with long histories?

• What guidance should the community follow when migrating from feature work to security-focused maintenance?

Written by ReadmeX AI from the project's README, source and public GitHub data; it may contain mistakes.

Read the original README https://github.com/gitleaks/gitleaks#readme

ReadmeX opened this community for a trending project; it is not run by the project. Maintainers can claim it from the community page.