Gitleaks

Gitleaks looks for passwords and API keys in your code and commit history. It only reads your local repository, so you can start by running it once on your own project.

This review is for developers who keep code on GitHub or similar services. After reading it, you can do the following:

• Search your repository’s commit history for secrets
• Block secrets automatically before you commit (pre-commit)
• Ignore false positives

##What Gitleaks does

Gitleaks has a command for each kind of target.

Each finding shows the file, line, commit, and the ID of the rule that matched. You can also save results as JSON, CSV, JUnit, or SARIF.

##Try it safely on your own repository

1. Download the file for your operating system from the releases page and extract it. Builds are available for Windows, macOS, and Linux. On macOS, brew install gitleaks also works.

2. Go to the folder of a repository you own.

3. Run the following command. With --redact, the secrets themselves are masked in the output.

   gitleaks git -v --redact

4. Gitleaks exits with code 0 if it finds nothing and 1 if it finds leaks. Use the file name and line number to check each finding.

Always add --redact when you share your screen or when others can see the logs.

##Block secrets before you commit with pre-commit

With pre-commit, Gitleaks runs on every git commit and stops commits that contain secrets.

1. Install pre-commit by following the official instructions.

2. Create .pre-commit-config.yaml at the root of your repository with this content:

   repos:
     - repo: https://github.com/gitleaks/gitleaks
       rev: v8.24.2
       hooks:
         - id: gitleaks

3. Run pre-commit autoupdate to update rev to the latest version.

4. Run pre-commit install to enable the hook.

The hook scans only staged changes (what you added with git add). If it finds a secret, the commit fails.

There are three hook IDs: gitleaks builds and runs Gitleaks with Go, gitleaks-docker runs the official Docker image, and gitleaks-system uses the Gitleaks already installed on your machine.

To skip the hook once, put SKIP=gitleaks in front of the command, as in SKIP=gitleaks git commit ....

##Reduce false positives

Values you write on purpose, such as dummy keys for tests, can trigger findings. Exclude them like this:

##Cautions

##Read next

• cd ../osv-scannerOSV-Scannerchecks dependencies for known vulnerabilities
• cd ../trivyTrivyscans container images and dependencies in one pass