gitleaks/gitleaks
Gitleaks
Gitleaks is a security scanning engine designed to identify hardcoded credentials, API keys, and other sensitive information within version control systems and local file structures. It functions as a static analysis tool that automates the detection of secrets, helping to prevent the accidental exposure of sensitive data during the development lifecycle.
The tool distinguishes itself through its ability to perform deep forensic analysis of git history, allowing users to audit entire project timelines or enforce security gates within continuous integration pipelines. It supports complex detection logic through composite rules and provides mechanisms for baseline management, which enables teams to ignore existing findings and focus exclusively on new security risks. By offering pre-commit hook integration and exit-code-based orchestration, it allows for the enforcement of security policies directly within developer workflows and automated build environments.
Beyond core scanning, the project provides a broad set of utilities for managing security findings, including support for decoding obfuscated strings, inspecting compressed archives, and filtering results through allowlisting or path exclusions. It facilitates compliance and reporting by exporting structured data, which can be integrated into external dashboards or tracking systems. The tool is built to handle various input sources, including direct file system traversal and standard input streams, ensuring compatibility with diverse development and deployment environments.
Features
- Secret Detection - Prevents sensitive information like API keys and passwords from being accidentally committed to version control.
- Secret Scanning Engines - Identifies hardcoded credentials and sensitive information within version control history and local file systems.
- Security Gates - Prevents the introduction of sensitive information into codebases by enforcing security policies during development.
- Security Auditing - Integrates automated security scans into development pipelines to identify vulnerabilities before production.
- Security Detection Logic - Enables complex security analysis by requiring multiple conditions to be met before flagging a finding.
- Automated Code Review - Automates security checks before every commit to prevent sensitive data from entering version control.
- Information Disclosure Tools - Tool for detecting secrets in source code.
- Security and Auditing - Detects secrets in Git repositories.
- Sicherheit und Datenschutz - Tool for detecting secrets in code repositories.
- Repository Sanitization - Scans the entire history of a project to identify and remove previously committed secrets.
- Security Finding Management - Allows users to suppress specific findings or mark them as false positives to streamline security workflows.
- Static Analysis - Inspects source code and configuration files for patterns matching known security vulnerabilities.
- Forensic Analysis Tools - Traverses commit logs and branch structures to detect historical security exposures and credential leaks.
- Version Control Utilities - Iterates through commit objects and tree structures to inspect file contents across repository history.
- Security Reporting Tools - Generates structured reports in JSON or CSV formats for integration with external security dashboards.
- Baseline Management - Ignores existing secrets by creating a baseline, allowing focus on new sensitive data in future commits.
- Commit History Analysis - Examines commit history and branches to identify hardcoded secrets introduced during development.
- CI/CD Orchestration - Communicates scan status to external systems using standard operating system exit codes.
- Archive Secret Scanners - Inspects compressed archives like zip or tar files to uncover embedded secrets during security scans.
