R-GIT
gitleaks
Scans git repositories and commit history for hardcoded secrets and credentials.
OVERVIEW
Gitleaks (github.com/gitleaks/gitleaks) is a Go-based scanner that walks a git repository's full commit history, not just the current checkout, applying a large set of regex-based detectors for API keys, private keys, tokens, and other credential patterns from common providers (AWS, GitHub, Slack, Stripe, and more).
Because it checks history rather than the working tree alone, it catches secrets that were committed and later 'deleted' in a later commit but never actually rotated — a common finding in engagements where a client believes a leaked key was removed simply because it's no longer in the latest commit.
USE CASES
Practical use cases
- 01
Scanning a client repository's full commit history for leaked API keys and credentials.
- 02
Running as a pre-commit hook or CI gate to stop new secrets before they're merged.
- 03
Confirming whether a 'removed' secret from an old commit was actually rotated afterward.
- 04
Auditing multiple repos in an org for the same leaked credential reused across projects.
QUICK START
Against any in-scope git repository, to catch hardcoded credentials and keys that source-code review alone tends to miss in history.
- Confirm which repositories (including private history, if accessible) are in scope for secret scanning.
- Install gitleaks from a release binary, package manager, or container image.
- Run a scan against the full clone, not just the latest checkout, to cover history.
- Verify each flagged match is a live, valid credential before reporting it, and note whether it appears rotated.
- Agree with the client on how flagged secrets get handled and disclosed, since the report itself will contain sensitive values.
gitleaks git -v --report-format json --report-path findings.json /path/to/repoBEFORE YOU RUN IT
What to check before running it
Findings expose the actual secret value in the report output — handle and store scan results per the client's data-handling agreement, not as a normal text finding.
Scanning full history surfaces secrets in commits authored by people who may no longer be with the organization; confirm with the client how historical findings should be attributed and disclosed.
Regex-based detection produces false positives on high-entropy strings that aren't secrets (hashes, test fixtures); confirm each flagged value is a live credential before reporting it.