Gitleaks

Gitleaks is a tool written in Go that detects confidential information such as password, API key, and token in go stores, files, and content given with stdin. With the Regex-based detection engine, it offers three scanning modes, go, dir, and stdin; it can be run as a pre-commit hook or GitHub Action. The project is complete in feature: no new feature is added, future versions will include only security patches, and developer focus has shifted to Betterleaks.

GI

gitleaks · Security & Penetration Testing

STARS30.5K
FORKS2.3K
COMMITS1.3K
CONTRIBUTORS234
VERSIONv8.9.0
UPDATED3 days ago
GoSecret ScanningGitMIT

Common commercial products in this category: Burp Suite Professional, Nessus, Cobalt Strike

What can it do?
  • You search for the password or API key stored in Git repositories and files.
  • You can scan your warehouse by adding a pre-commit hook.
  • Using Gitleaks-Action, you include scanning operations in your CI/CD processes.
Heads up
  • • High number of open issues (522)
User reviews
  • • NeutralHacker News

    I wrote Gitleaks, now I'm maintaining Betterleaks

    “8 years ago I wrote the first lines of Gitleaks and have been hooked on finding leaked secrets since. Gitleaks grew from a small project to a name recognized by developers and security folks. It sucks but I gotta take a step back from the project. I'll cut security releases but…”

Verified against README · Oct 26, 2026 · source

My note

Alternative pages

More in: Security & Penetration Testing