Gitleaks
A fast, open-source scanner that detects hardcoded secrets — passwords, API keys, tokens — in git history, files or CI pipelines using customizable regex rules.
🔗 Visit Gitleaks
Description
Committing a password or API key to git by accident happens to everyone eventually, and once it's in the history, simply deleting the line later isn't enough — it's still recoverable. Gitleaks catches this before or after the fact: it scans your repository (including full commit history) for patterns that look like secrets and flags them, so you can rotate the credential and scrub the history before it's exploited.
Gitleaks scans git repositories, directories or stdin using customizable TOML rule sets, with entropy analysis to catch secrets that don't match a known pattern, detection of base64/hex/percent-encoded secrets, baseline comparison to ignore already-known findings, and output in JSON, CSV, JUnit or SARIF for CI integration. It plugs into pre-commit hooks and GitHub Actions, and is free and open source under the MIT license, with 28.9k GitHub stars and 1,291 commits.
💬 Our review
The short version: gitleaks is the fast, no-friction way to stop secrets from ever landing in git — install the pre-commit hook once and it silently blocks the commit before the leak happens.
Against TruffleHog, gitleaks is lighter and simpler: it matches patterns and flags them without trying to verify the credential against a live service, which means faster scans but more manual triage of what's a real leak versus a false positive. Its MIT license is more permissive than TruffleHog's AGPL-3.0, which matters if you're bundling it into commercial tooling. Worth knowing: the maintainer has described gitleaks as feature-complete, with development effort shifting toward a newer commercial project (Betterleaks) — gitleaks itself still receives security patches but isn't gaining new capabilities. For the core job of blocking secrets at commit time or scanning CI pipelines, it remains one of the fastest and easiest tools to set up, and it's completely free.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Projet open source (licence MIT), aucune offre payante
Pros
Configuration de règles complète via TOML
Plusieurs formats de sortie (JSON, CSV, JUnit, SARIF)
Intégration facile en pre-commit hook et GitHub Actions
Mécanismes d'allowlist pour réduire les faux positifs
28 900+ étoiles GitHub, licence MIT permissive
Cons
Fonctionnalités figées, plus de nouvelles capacités prévues
Détection basée sur regex/entropie, limitée face à l'obfuscation
Nécessite de créer ses propres règles pour des formats de secrets spécifiques