security enabled verified low v1.0.0

gitleaks

SAST tool for detecting secrets, passwords, API keys, tokens, and other sensitive data in git repositories.

📋 Live Preview 
gitleaks {flag-verbose} {flag-log-level} {flag-no-git} {flag-format} {flag-exit-code} {flag-redact} {flag-config} {flag-repo-path} {flag-repo-url}
📎 flag-verbose 📎 flag-log-level 📎 flag-no-git 📎 flag-format 📎 flag-exit-code 📎 flag-redact 📎 flag-config 📎 flag-repo-path 📎 flag-repo-url 
gitleaks {flag-verbose} {flag-log-level} {flag-no-git} {flag-format} {flag-exit-code} {flag-redact} {flag-config} {flag-repo-path} {flag-repo-url}

Sandbox: execFile · Timeout: 300s

Capabilities

secrets.scan.repo
secrets.scan.diff
secrets.detect.api-key
secrets.detect.password
secrets.detect.token

Parameters

Name Type Required Default Description Aliases
flag-config string No - Config file path -c, --config
flag-repo-path string No - Repository path to scan -r, --repo-path
flag-repo-url string No - Repository URL to scan -u, --repo-url
flag-verbose boolean No - Verbose output -v, --verbose
flag-log-level string No - Log level (debug, info, warn, error) --log-level
flag-no-git boolean No - Scan a directory without git history --no-git
flag-format string No - Output format (json, csv, sarif) -f, --format
flag-exit-code boolean No - Non-zero exit code if leaks found --exit-code
flag-redact boolean No - Redact secrets from output --redact

Artifacts

TypeDescriptionMIMESchemaTrust
secrets.scan.reportSecret detection reporttext/plain-verified
secrets.scan.jsonJSON format reportapplication/json-verified

Contract

Inputs

git.repo.path

Repository path or URL to scan

Outputs

secrets.scan.report

Detected secrets report

secrets.scan.json

JSON format findings

Side effects:

Workflow Edges

Produces

secrets.scan.reportsecrets.scan.json

Consumes

git.repo.path

Resource Profile

ResourceValue
CPUmedium
Memory128 MB
Networkmedium
Disk I/Olow

Examples

Scan local repository

gitleaks -r /path/to/repo

Scan remote repository URL

gitleaks -u https://github.com/user/repo

Scan with JSON output

gitleaks -r /path/to/repo -f json -o findings.json

Scan directory without git history

gitleaks --no-git -r /path/to/directory

Scan with custom config and redact secrets

gitleaks -r /path/to/repo -c gitleaks.toml --redact

Documentation

gitleaks — Secrets Scanner

gitleaks is a Static Application Security Testing (SAST) tool for detecting hardcoded secrets like passwords, API keys, tokens, and SSH keys in git repositories. It can scan local directories, git history, or remote repository URLs.

Usage

# Scan local repository
gitleaks -r /path/to/repo

# Scan remote repository
gitleaks -u https://github.com/user/repo

# JSON output with exit code
gitleaks -r /path/to/repo -f json -o findings.json --exit-code

# Scan without git history
gitleaks --no-git -r /path/to/directory

# Scan with redaction
gitleaks -r /path/to/repo --redact

Related Tools

trufflehoggitrobshhgit

References