gitleaks
by gitleaks
Gitleaks is a command-line tool that scans git repositories, folders and piped text for passwords, API keys and tokens that have been committed by mistake. It helps teams catch leaked credentials before or after they reach a shared repository.
- Stars
- 30.5k +38 a day
- Licence
- MIT
- Runs on
- Your computer
- Setup
- Easy
- Language
- Go
- Age
- 3197 days
What you can do with it
- Scan a whole git history for exposed passwords, API keys and tokens
- Block commits that contain secrets by adding it as a pre-commit hook
- Run it in CI pipelines or GitHub Actions and export reports as JSON, CSV or SARIF
Could replace
- GitGuardian
- GitHub Advanced Security
Our suggestion based on what it does, not a feature-by-feature comparison.
Make money with it
A freelancer could offer a fixed-price security audit that scans a client's repositories for leaked secrets and delivers a clear report.
An idea, not financial advice. Check the licence before charging for anything built on it.
Ways a business could use it
- Check client or company code for leaked credentials before it is shared or published, avoiding costly breaches
- Add automatic secret checks to your build pipeline instead of paying for a commercial scanning service
Can you use it commercially?
Free to use, change and sell, including in paid products. Keep the copyright notice.
Not legal advice. Read the project's licence file before building a product on it.
Getting it running
Install with Homebrew, Docker, a downloaded binary from the releases page, or build from source with Go.
Follow the official instructions in the project README.
Things to check
- The author says it is feature complete and will only get security patches, as focus has moved to a successor called Betterleaks
- Regex-based detection can produce false positives and miss some secrets
Checked 29 Oct 2026. Summary drafted by AI from the project's README.
