zricethezav/gitleaks
Gitleaks
Gitleaks is a static analysis security tool and secret detection engine designed to find hardcoded passwords, API keys, and authentication tokens. It functions as a Git secret scanner that analyzes both local file systems and Git commit history to prevent credential leaks.
The tool distinguishes itself through a decoding pipeline that transforms base64 and hex strings into plaintext to find obfuscated secrets. It further reduces false positives using proximity-based validation and fingerprint-based suppression to filter out known or baseline findings.
The system covers a broad range of detection capabilities, including recursive archive extraction and commit-history traversal. It supports automated workflows for integration into continuous integration and delivery pipelines, allowing for custom secret detection rules and the generation of structured scan reports for compliance auditing.
Features
- Secrets Scanning - Provides comprehensive scanning of both the current filesystem and full Git commit history to detect hardcoded credentials.
- Credential Leak Prevention - Identifies and helps remove accidentally committed secrets from codebases using regex and custom rules.
- DevSecOps And Hardening - Functions as an automated check for commit hooks and CI workflows to prevent secret leaks.
- Static Code Analysis - Employs static analysis using regular expressions and proximity matching to identify credentials in source code.
- Commit History Analysis - Analyzes Git object graphs and patches to identify secrets hidden within previous versions of the code.
- Secret-Focused History Analysis - Analyzes commit ranges and patches to identify sensitive credentials committed to the version history.
- CI Workflow Automations - Integrates secret detection into commit processes and CI/CD workflows to prevent credentials from entering repositories.
- CI/CD Pipeline Integrations - Implements automated security checks within CI/CD pipelines to block the push of sensitive credentials.
- Git Secret Scanners - Detects hardcoded passwords, API keys, and tokens within Git history and local file systems.
- Encoded Secret Decoding - Implements a decoding pipeline that transforms base64 and hex strings into plaintext to uncover obfuscated secrets.
- Secret Scanning Engines - Provides a core scanning engine that decodes encoded strings to find hidden credentials.
- Regex Pattern Matchers - Uses regular expressions to identify sensitive credentials based on predefined and custom rule sets.
- Recursive Archive Traversers - Recursively unpacks compressed files during scanning to analyze nested content for hardcoded secrets.
- Secret Suppressions - Supports suppressing known or test credentials via inline comments and fingerprint files to reduce false positives.
- Security Automation Workflows - Automates the discovery and filtering of secrets throughout a project's history to ensure codebase security.
- Obfuscated Data Decoders - Provides a decoding pipeline that transforms base64 and hex strings into plaintext to uncover obfuscated credentials.
- Secret Detection Rules - Allows the definition of specialized detection patterns and proximity rules via configuration files.
- Secret Fingerprinting - Filters out known secrets by comparing cryptographic hashes of findings against a baseline file.
- Archive Content Scanning - Recursively searches for secrets inside compressed files by extracting and scanning zip or tar archives.
- Baseline Filtering - Provides baseline filtering to ensure only newly introduced leaks are flagged during subsequent scans.
- Keyword Proximity Validation - Reduces false positives by verifying if specific keywords appear near a potential secret match.
- Reconnaissance - Detecting hardcoded secrets in version control repositories.
- Reconnaissance Tools - Detecting hardcoded secrets in git repositories.
- Vulnerability Scanners - Scans repositories for secrets using regex and entropy.
- Credential Harvesting - Scans Git repositories for secrets.
- Data Leakage Detection - Searches repository history for leaked secrets and keys.
- Offensive Security Tools - Audits git repositories for hardcoded secrets.
- Secret Detection - Scans repositories for hardcoded secrets and keys.
- Secret Management - Automated auditing of Git repositories for exposed secrets.
- Secret Scanners and Credential Auditing - Audit tool for detecting secrets in git history.
- Secret Scanning - SAST tool for finding secrets in Git repositories.
- Secrets Scanning - Scans git commit history for hardcoded passwords and API tokens.
- Security and Vulnerability Scanning - Detects hardcoded secrets in git repositories.
