Which secrets are sitting in my codebase right now, and exactly where?

scans the working directory, git history, or piped input against its regex and entropy rules and reports the matching secret, file, line, and commit for each hit

Did someone commit a credential that was later deleted but never rotated?

walks the full git history rather than just the current tree, so a key removed in a later commit still surfaces tied to the commit that introduced it

Is there a live credential buried inside a build artifact or release archive?

extracts zip and tar files up to a configured depth and scans their contents, reporting nested hits with the inner path spelled out so you can trace which archive-within-archive held it

Would an obfuscated or encoded secret slip past a plain text search of my repo?

recursively decodes hex, base64, and URL/percent-encoded content before matching, catching secrets that are wrapped a few layers deep

Which finding is the real leak versus just a look-alike username-and-password pattern in a config file?

applies proximity-aware composite rules that only fire when auxiliary conditions match within a set number of lines or columns, cutting down false positives from incidental matches

gitleaks release history — The Cyber Toolchain

v8.30.0 Nov 26, 2025 · release notes

gitleaks v8.30.0 adds Looker client ID/secret and Airtable Personal Access Token detection rules

└──▷ GET THIS VERSION

$ git clone --branch v8.30.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.30.0

Adds detection rules for Looker client ID and client secret credentials.
Adds detection rule for Airtable Personal Access Tokens.
Documents recursive decoding behavior (0 to 5 levels) for encoded secret detection.

3 details in Everything

v8.29.0 Nov 4, 2025 · release notes

Gitleaks v8.29.0 adds Amazon Bedrock API key detection, improved Sonar token regex, config min version enforcement, and trace logging for skipped archives.

└──▷ GET THIS VERSION

$ git clone --branch v8.29.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.29.0

Adds detection rule for Amazon Bedrock API keys.
Improves Sonar token detection regex to match tokens with prefixes.
Adds min-version enforcement in config files to require a minimum Gitleaks version.
Adds trace-level logging when archive files are skipped because archive scanning is not enabled.

4 details in Everything

v8.28.0 Jul 20, 2025 · release notes

gitleaks v8.28.0 adds composite (multi-part) rules with proximity matching, Anthropic and Artifactory secret detections, and allowlist optimizations.

└──▷ GET THIS VERSION

$ git clone --branch v8.28.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.28.0

└──▷ USE IT

Require a username-like token to appear within 2 lines of a password pattern — reducing false positives in config files.

toml

# In your gitleaks.toml
[[rules]]
id = "my-service-password"
description = "My service password"
regex = '''password\s*=\s*["']?([\w!@#$%^&*]+)["']?'''

  [[rules.required]]
  id = "my-service-username"
  withinLines = 2

[[rules]]
id = "my-service-username"
description = "My service username"
regex = '''username\s*=\s*["']?([\w]+)["']?'''

Adds composite rules ([[rules.required]]) that let a primary rule report a finding only when one or more auxiliary rules also match, with optional withinLines and withinColumns proximity constraints.
Supports fragment-level, line-bounded, column-bounded, and combined line+column proximity matching for composite rules.
Adds built-in detection for Anthropic API keys.
Adds built-in detection for Artifactory reference tokens and API keys.
Promotes allowlist stopword optimizations for faster scanning.

+1 more show less

Defers newline calculation in fragments until a rule match occurs, significantly reducing scan time on large repositories.

6 details in Everything

v8.27.1 Jun 8, 2025 · release notes

gitleaks v8.27.1 adds Heroku API key detection and new Bitbucket/Gitea platform support

└──▷ GET THIS VERSION

$ git clone --branch v8.27.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.27.1

Adds detection rule for the new Heroku API Key format (new version pattern).
Adds Bitbucket as a supported platform for secret scanning.
Adds Gitea as a supported platform for secret scanning.

3 details in Everything

v8.27.0 Jun 1, 2025 · release notes

Gitleaks v8.27.0 adds recursive archive scanning to detect secrets inside zip files, tarballs, and nested archives.

└──▷ GET THIS VERSION

$ git clone --branch v8.27.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.27.0

└──▷ TRY IT

Scan a directory including zip/tar archives up to 3 levels deep to catch secrets bundled into build artifacts or release packages.

$ gitleaks dir --max-archive-depth=3 /path/to/repo

Scan a git repository's history including any archived secrets, with recursion capped at 2 levels.

$ gitleaks git --max-archive-depth=2 /path/to/repo

Adds --max-archive-depth flag to enable automatic extraction and scanning of archive files (zip, tar, etc.) during dir and git scan types.
Supports recursive archive scanning so secrets nested inside archives-within-archives are discovered up to the configured depth limit.
Reports archive-contained findings with !-separated inner paths (e.g., nested.tar.gz!inner.tar!files/.env.prod) for precise location tracking.
Adds diagnostics output for improved visibility into scan behavior.
Adds Unicode decoding support for broader file content handling.

5 details in Everything

v8.26.0 May 12, 2025 · release notes

Gitleaks v8.26.0 adds percent/URL decoding, slow-file identification, and 1Password secret key detection.

└──▷ GET THIS VERSION

$ git clone --branch v8.26.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.26.0

└──▷ TRY IT

Scan a directory for secrets that may be URL-encoded (e.g. base64 wrapped in percent-encoding) by enabling multi-layer decoding.

$ ./gitleaks dir <path> --max-decode-depth=2

Adds percent/URL decoding support alongside existing hex and base64 decoders, enabled via --max-decode-depth.
New slow-file identification surfaces files that are causing performance bottlenecks during scanning.
Adds built-in detection rule for 1Password secret keys.

3 details in Everything

v8.25.0 Apr 29, 2025 · release notes

Gitleaks v8.25.0 adds multi-global-allowlist support, Perplexity AI and ClickHouse secret detection, and higher GCP entropy rules.

└──▷ GET THIS VERSION

$ git clone --branch v8.25.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.25.0

└──▷ USE IT

Suppress known-safe strings and paths across all rules using multiple independent global allowlists — useful when different teams own different suppression policies.

toml

# .gitleaks.toml
[[allowlists]]
description = "team-a allowlist"
regexes = ["SAFE_TOKEN_A"]

[[allowlists]]
description = "team-b allowlist"
paths = ["tests/fixtures/.*"]

Supports defining multiple global allowlists in config, enabling layered suppression strategies across rule sets.
Adds detection rule for Perplexity AI API keys.
Adds detection rule for ClickHouse credentials.
Increases entropy threshold for GCP rules to reduce false positives while sharpening true detections.
Validates and sorts rules automatically when generating rule configs.

5 details in Everything

v8.24.3 Apr 11, 2025 · release notes

Gitleaks v8.24.3 adds GitLab Runner, Azure DevOps, MaxMind, OpenAI, and Slack Triggers detections plus env-var config support.

└──▷ GET THIS VERSION

$ git clone --branch v8.24.3 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.24.3

└──▷ TRY IT

Supply a complete Gitleaks config in CI without writing a file to disk — useful in ephemeral runners where you control env vars but not the filesystem.

$ export GITLEAKS_CONFIG_TOML="$(cat .gitleaks.toml)"
gitleaks detect --source .

Adds detection rule for GitLab Runner Tokens (Routable).
Adds detection rule for MaxMind license keys.
Adds updated regex pattern for OpenAI API keys.
Adds detection rule for Slack Workflow trigger URLs (hooks.slack.com/triggers/).
Adds Azure DevOps platform support in SCM detection and source-link generation.

+1 more show less

Enables setting the full Gitleaks config via the GITLEAKS_CONFIG_TOML environment variable (inline TOML content, no file required).

6 details in Everything

v8.24.2 Mar 22, 2025 · release notes

gitleaks v8.24.2 adds report-format inference from file extension and makes go-re2 opt-in

└──▷ GET THIS VERSION

$ git clone --branch v8.24.2 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.24.2

└──▷ TRY IT

Let gitleaks pick the report format automatically by naming your output file — no need to specify --report-format separately.

$ gitleaks detect --report-path findings.sarif

Infers --report-format automatically from the --report-path file extension when no format is explicitly provided.
Switches to standard Go regexp by default; go-re2 is now opt-in via a separate build tag.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!go-re2 is no longer the default regexp engine; builds that relied on go-re2 behavior by default must now explicitly opt in.

v8.24.0 Feb 20, 2025 · release notes

Gitleaks v8.24.0 adds Sonar, Sourcegraph, and .p12 file rules plus streaming DetectReader support and a new git link-generation toggle.

└──▷ GET THIS VERSION

$ git clone --branch v8.24.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.24.0

New Sonar secret detection rule.
New Sourcegraph token detection rule.
New rule to detect secrets in .p12 files.
Adds streaming support via DetectReader, enabling detection on streamed input without buffering the entire source.
Adds deno.lock to default path exclusions, reducing noise in Deno projects.

+1 more show less

Paths and fingerprints are now computed in a platform-agnostic way, making results consistent across Windows and Unix.

6 details in Everything

v8.23.3 Jan 29, 2025 · release notes

Gitleaks v8.23.3 enhances the curl-auth-user rule to catch empty usernames or passwords.

└──▷ GET THIS VERSION

$ git clone --branch v8.23.3 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.23.3

v8.23.2 Jan 24, 2025 · release notes

Gitleaks v8.23.2 adds base64 API key detection, Cisco Meraki rule, git link reporting, and password redaction in remote URLs.

└──▷ GET THIS VERSION

$ git clone --branch v8.23.2 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.23.2

Detects base64-encoded secrets with the updated generic-api-key rule.
New detection rule for Cisco Meraki API keys.
Adds a Facebook keyword for secret detection.
Includes a source link in the report output for each finding.
Redacts passwords from remote URLs in git operations.

5 details in Everything

v8.23.1 Jan 15, 2025 · release notes

Gitleaks v8.23.1 adds the ability to disable extended rules via config.

└──▷ GET THIS VERSION

$ git clone --branch v8.23.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.23.1

Supports disabling individual extended rules in config, giving teams fine-grained control over which inherited rules are active.

1 detail in Everything

v8.23.0 Jan 13, 2025 · release notes

Gitleaks v8.23.0 lets rules define multiple allowlists with AND/OR conditions to cut false positives

└──▷ GET THIS VERSION

$ git clone --branch v8.23.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.23.0

└──▷ USE IT

Suppress noisy findings in lockfiles only when the match text contains a known false-positive pattern — use AND so both path and regex must be satisfied.

toml

# In .gitleaks.toml
[[rules]]
id = "example-rule"
regex = '''(?i)secret[_-]?key'''

  [[rules.allowlists]]
  condition = "AND"
  regexTarget = "match"
  regexes = [ '''(?i)parseur[il]''' ]
  paths = [ '''package-lock\.json''' ]

Ignore findings on generated dependency files OR on known safe commits without touching other allowlist entries.

toml

# In .gitleaks.toml
[[rules]]
id = "example-rule"
regex = '''(?i)api[_-]?key'''

  [[rules.allowlists]]
  description = "generated files and known safe commits"
  condition = "OR"
  commits = [ "a1b2c3d" ]
  paths = [ '''go\.mod''', '''go\.sum''' ]
  stopwords = [ '''client''', '''endpoint''' ]

  [[rules.allowlists]]
  condition = "AND"
  regexTarget = "line"
  regexes = [ '''(?i)example''' ]
  paths = [ '''README\.md''' ]

Supports multiple [[rules.allowlists]] blocks per rule, so a finding is suppressed when ANY listed allowlist matches.
Adds condition field (OR / AND) to allowlist blocks, enabling precise control — OR to match any criterion, AND to require all criteria simultaneously.
Adds regexTarget field (secret, match, or line) to allowlist blocks, letting you apply regex checks against the full match or entire line instead of just the extracted secret.
Adds comma as a valid operator in GenerateSemiGenericRegex, broadening auto-generated pattern coverage.

4 details in Everything

v8.22.1 Dec 30, 2024 · release notes

Gitleaks v8.22.1 adds entropy tracing to help explain why a secret triggered a detection.

└──▷ GET THIS VERSION

$ git clone --branch v8.22.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.22.1

Adds entropy trace output to detection results, surfacing the entropy calculation that contributed to a finding.

1 detail in Everything

v8.22.0 Dec 20, 2024 · release notes

Gitleaks v8.22.0 replaces Go's regex engine with go-re2, delivering 2–4× faster secret scanning.

└──▷ GET THIS VERSION

$ git clone --branch v8.22.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.22.0

v8.21.3 Dec 19, 2024 · release notes

Gitleaks v8.21.3 adds new secret detections, user-defined report templates, line numbers in reports, and STDOUT output support.

└──▷ GET THIS VERSION

$ git clone --branch v8.21.3 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.21.3

Adds SettleMint API key detection.
Adds GitLab routable token detection.
Adds Freemius secret key detection.
Adds Sentry.io token detection for the new token format.
Adds new Jira API token pattern detection.

+7 more show less

Supports user-defined report templates via custom template files.
Outputs report to STDOUT when no report file is specified, enabling pipeline-friendly usage.
Adds optional Line field inclusion in reports for precise finding location.
Improves directory scan chunking for better performance scanning large files.
Continues directory scans on permission errors instead of halting.
Updates global and generic allowlist rules.
Adds human-readable descriptions for curl rules.

12 details in Everything

v8.21.2 Oct 28, 2024 · release notes

Gitleaks v8.21.2 adds Octopus Deploy, 1Password, and new GitLab token rules plus curl header detection.

└──▷ GET THIS VERSION

$ git clone --branch v8.21.2 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.21.2

Adds detection rule for Octopus Deploy API keys.
Adds detection rules for new GitLab token formats.
Adds detection rule for 1Password tokens.
Adds curl header rule to catch secrets passed via HTTP headers.
Expands AWS access token rule with entropy checks and an allowlist.

+5 more show less

Tunes generic-api-key rule with additional entropy filtering and keyword exclusions to reduce false positives.
Updates global allowlist to suppress common false-positive paths and patterns.
Adds automatic ignoring of jQuery and Swagger-UI static assets to reduce noise in web projects.
Bumps Okta token entropy threshold to 4 for higher-confidence detections.
Adds identifier left-side matching to broaden secret context detection.

10 details in Everything

v8.21.1 Oct 18, 2024 · release notes

Gitleaks v8.21.1 adds a built-in detection rule for curl basic auth credentials.

└──▷ GET THIS VERSION

$ git clone --branch v8.21.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.21.1

v8.21.0 Oct 15, 2024 · release notes

Gitleaks v8.21.0 adds multiple allowlists per rule and a new Azure AD client secret detector.

└──▷ GET THIS VERSION

$ git clone --branch v8.21.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.21.0

└──▷ USE IT

Suppress different categories of false positives independently within a single rule by defining multiple named allowlists.

toml

# In your gitleaks.toml
[[rules]]
id = "my-rule"
description = "Example rule with multiple allowlists"
regex = '''some-secret-pattern'''

[[rules.allowlists]]
description = "Allow test files"
paths = ['''tests/.*''']

[[rules.allowlists]]
description = "Allow known placeholder values"
regexes = ['''placeholder-value''']

Supports defining multiple allowlists per rule, enabling finer-grained suppression logic within a single rule definition.
Adds detection for Azure AD client secrets.
Matches gitleaks.toml config file anywhere in the directory tree, not just the repo root.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Findings previously suppressed via .gitleaksignore may reappear: gitleaks now records the correct commit SHA where a secret was introduced instead of the merge commit SHA, so existing ignore-list entries keyed to merge commit SHAs will no longer match.

v8.20.1 Oct 7, 2024 · release notes

Gitleaks v8.20.1 adds PrivateAI, Cohere, and NuGet config password rules plus global allowlist placeholder regexes.

└──▷ GET THIS VERSION

$ git clone --branch v8.20.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.20.1

Adds PrivateAI secret detection rule to catch PrivateAI API keys in repos.
Adds Cohere secret detection rule to identify Cohere API keys.
Adds NuGet config password rule to detect credentials in NuGet configuration files.
Supports placeholder regexes in the global allowlist, enabling broad suppression of known-safe patterns across all rules.

4 details in Everything

v8.20.0 Oct 3, 2024 · release notes

Gitleaks v8.20.0 adds automatic Base64 decoding to uncover secrets hidden in encoded text.

└──▷ GET THIS VERSION

$ git clone --branch v8.20.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.20.0

└──▷ TRY IT

Scan a repo for secrets hidden inside Base64-encoded strings, allowing up to 3 levels of nested encoding.

$ gitleaks detect --source . --max-decode-depth 3

Adds --max-decode-depth flag to enable automatic detection and decoding of Base64-encoded (standard and base64url) content during scans.
Supports recursive decoding so secrets nested inside multiply-encoded strings are also surfaced.
Tags findings from encoded content with decoded:<encoding> and decode-depth:<depth> for easy filtering.
Prints rule tags in findings output when tags are present.

4 details in Everything

v8.19.3 Sep 26, 2024 · release notes

Gitleaks v8.19.3 adds a Fly.io secret rule, comment support in .gitleaksignore, and sharpened GCP/GitHub detections.

└──▷ GET THIS VERSION

$ git clone --branch v8.19.3 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.19.3

└──▷ USE IT

Document why a token is ignored by adding inline comments to your .gitleaksignore file.

ini

# .gitleaksignore
# Ignore test fixture token — not a real secret
abc123def456:generic-api-key

Adds a new built-in detection rule for Fly.io secrets.
Supports comment strings in .gitleaksignore files, making ignore lists self-documenting.
Adds entropy scoring to the GitHub token detection rule to reduce noise.
Updates the GCP API key rule with improved detection logic.

4 details in Everything

v8.19.0 Sep 14, 2024 · release notes

Gitleaks v8.19.0 adds new git, dir, and stdin commands plus Kubernetes and OpenShift secret detection rules.

└──▷ GET THIS VERSION

$ git clone --branch v8.19.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.19.0

└──▷ TRY IT

Scan a git repository for secrets using the new git subcommand instead of the deprecated detect.

$ gitleaks git --source . --report-path gitleaks-report.json

Scan a directory (non-git) for secrets using the new dir subcommand.

$ gitleaks dir --source /path/to/project --report-path gitleaks-report.json

Pipe content into gitleaks for secret detection using the new stdin subcommand, e.g. in a CI pre-receive hook.

$ cat secrets.env | gitleaks stdin

Adds new top-level git, dir, and stdin subcommands as the modern replacements for detect and protect.
New detection rule for Kubernetes secrets.
New detection rule for OpenShift user tokens.
New detection rules for Harness Personal Access Tokens (PAT) and Service Account Tokens (SAT).
Makes config generation utilities public for programmatic use.

+3 more show less

Adds poetry.lock, gradle verification-metadata.xml, go.work, and go.work.sum to the global allowlist paths.
Uses the first non-empty capture group when secretGroup is not set, reducing required rule configuration.
Updated rule validation now uses rule ID in config validation errors for clearer feedback.

8 details in Everything

└──▷ BREAKING ON UPGRADE

!The detect and protect subcommands are deprecated in favor of git, dir, and stdin; the change is intended to be backwards compatible but may break existing scripts or tooling.

v8.18.4 Jun 14, 2024 · release notes

New detections for NewRelic insert key and intra42 client secret

└──▷ GET THIS VERSION

$ git clone --branch v8.18.4 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.18.4

Adds support for detecting NewRelic insert keys
Adds support for detecting intra42 client secrets

2 details in Everything

v8.18.3 Jun 1, 2024 · release notes

New detections for Facebook access tokens, Cloudflare API keys, Square update tokens, and ordered rule extension logic.

└──▷ GET THIS VERSION

$ git clone --branch v8.18.3 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.18.3

Adds detection rules for Facebook access tokens and page access tokens
Adds detection rules for Cloudflare API and Origin CA keys
Adds detection rule for Square update tokens
Adds mailchimp token patterns to existing detection coverage
Extends FB access token discovery capabilities

+1 more show less

Changes rule loading behavior by appending ordered rules when extending configurations

6 details in Everything

v8.18.2 Feb 1, 2024 · release notes

gitleaks v8.18.2 adds pre-commit hook support and extends --max-target-megabytes to --no-git mode

└──▷ GET THIS VERSION

$ git clone --branch v8.18.2 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.18.2

Extends --max-target-megabytes flag to work with --no-git flag for scanning arbitrary directories without git history.

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!protect and detect are now merged into one command (likely gitleaks protect or similar unified entry point).

v8.18.1 Nov 17, 2023 · release notes

New --ignore-gitleaks-allow flag, per-rule selection, optional case insensitivity, and new detection rules for Hugging Face and Scalingo.

└──▷ GET THIS VERSION

$ git clone --branch v8.18.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.18.1

└──▷ USE IT

Bypass allowlist rules to ensure no secrets are hidden by project-specific allowances.

shell

gitleaks detect --path . --ignore-gitleaks-allow

Adds --ignore-gitleaks-allow CLI flag to bypass allowlist entries during scans
Enables selection of a single rule via the new rule filtering mechanism (#1183)
Makes case insensitivity optional for rule detection patterns (#1215)
Adds detection for Hugging Face access tokens (#1204)
Adds detection for Scalingo API Token (#1262)

+1 more show less

Enables detection of base64-encoded JWTs (#1256)

6 details in Everything

└──▷ BREAKING ON UPGRADE

!The secretgroup is removed from the default configuration file.

v8.18.0 Aug 22, 2023 · release notes

gitleaks v8.18.0 adds JFrog API/Identity key detection and entropy checks for Plaid secrets.

└──▷ GET THIS VERSION

$ git clone --branch v8.18.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.18.0

Adds JFrog API and Identity key detection rules to enable scanning for JFrog credentials in repositories
Adds entropy check to Plaid client/secret ID rules to reduce false positives when detecting Plaid secrets

2 details in Everything

v8.17.0 Jun 15, 2023 · release notes

gitleaks v8.17.0 adds JUnit report format, tags for CSV/SARIF, and new token detections

└──▷ GET THIS VERSION

$ git clone --branch v8.17.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.17.0

Adds JUnit XML output format for scan results via the --report-format=junit flag
Adds tags field support in CSV and SARIF output formats
Adds detection rules for Snyk tokens, Makefile variables, and OpenAI API keys
Updates generic-api-key rule to ignore REDACTED in stopwords

4 details in Everything

v8.16.3 Apr 19, 2023 · release notes

Adds Authress access key and Defined Networking API token detection patterns

└──▷ GET THIS VERSION

$ git clone --branch v8.16.3 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.16.3

Add Authress access key format adds support for scanning Authress service client secrets.
Add Defined Networking API Tokens adds support for scanning Defined Networking API tokens.

2 details in Everything

v8.16.2 Mar 30, 2023 · release notes

gitleaks v8.16.2 adds detection formats for Authress access keys and Defined Networking API Tokens

└──▷ GET THIS VERSION

$ git clone --branch v8.16.2 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.16.2

Adds authress-access-key format to detect Authress service client secrets.
Adds defined-networking-api-token format to detect Defined Networking API tokens.

2 details in Everything

v8.16.0 Feb 26, 2023 · release notes

Adds regexTarget config key to .gitleaks.toml allowlist sections

└──▷ GET THIS VERSION

$ git clone --branch v8.16.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.16.0

Enables filtering findings based on context (the surrounding line) rather than just the extracted secret value.

1 detail in Everything

v8.15.0 Oct 13, 2022 · release notes

Adds --pipe and --follow-symlinks flags for new scanning workflows

└──▷ GET THIS VERSION

$ git clone --branch v8.15.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.15.0

└──▷ USE IT

Scan secret exposure in raw git patch output without creating temporary files.

shell

git log -p | gitleaks detect --pipe

Ensure symlinks are included when scanning local directories outside of git repos.

shell

gitleaks --source . --no-git --follow-symlinks

Adds --pipe flag to detect secrets from standard input.
Adds --follow-symlinks flag to traverse symbolic links during scanning.

2 details in Everything

v8.14.0 Oct 10, 2022 · release notes

Adds --max-target-megabytes flag to limit scan file size and new detection rules for DigitalOcean tokens and Slack Workflow Webhooks.

└──▷ GET THIS VERSION

$ git clone --branch v8.14.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.14.0

└──▷ USE IT

Scan a large repository but skip scanning files larger than 50MB to improve performance.

shell

gitleaks detect --source . --max-target-megabytes 50

Add --max-target-megabytes flag to set maximum file/blob size for scanning
Detect Slack Workflow Webhook URLs

2 details in Everything

v8.13.0 Sep 22, 2022 · release notes

gitleaks v8.13.0 adds --quiet flag, Telegram detection, baseline support

└──▷ GET THIS VERSION

$ git clone --branch v8.13.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.13.0

└──▷ USE IT

Run gitleaks without the banner text for easier log parsing or CI output clarity.

shell

gitleaks detect --source . --quiet

Configure a baseline file to suppress existing secrets during incremental scans.

toml

[baseline]
path = "gitleaks-baseline.toml"

Adds --quiet flag to silence the banner output for cleaner CLI usage.
Adds new detection rule for Microsoft Teams webhooks secret format.
Adds baseline configuration option to ignore previously known findings.

3 details in Everything

v8.12.0 Sep 4, 2022 · release notes

Adds fingerprint field to output and enables pretty-printed formatting for results

└──▷ GET THIS VERSION

$ git clone --branch v8.12.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.12.0

Adds fingerprint field to detection output
Introduces prettified output format by default

2 details in Everything

v8.10.0 Aug 7, 2022 · release notes

Adds gitleaksignore directive to ignore findings and new detection rules for Vault tokens and Sidekiq secrets

└──▷ GET THIS VERSION

$ git clone --branch v8.10.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.10.0

Introduces the # gitleaksignore comment directive to exclude specific lines from scanning results
Adds a new detection rule for JSON Web Tokens (JWT)

2 details in Everything

v8.9.0 Jul 27, 2022 · release notes

Adds extend config section to support chaining configuration files.

└──▷ GET THIS VERSION

$ git clone --branch v8.9.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.9.0

Adds [extend] config section with useDefault = true and path keys to extend base gitleaks configurations
Allows extension chains up to a depth of 2 via the new [extend] config

2 details in Everything

└──▷ BREAKING ON UPGRADE

!useDefault and path cannot be used together in the [extend] section; previously neither existed.

v8.8.5 May 25, 2022 · release notes

gitleaks v8.8.5 adds native Algolia key detection support.

└──▷ GET THIS VERSION

$ git clone --branch v8.8.5 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.8.5

Improves PlanetScale token detection accuracy

1 detail in Everything

v8.2.0 Dec 9, 2021 · release notes

Add --config flag and GITLEAKS_CONFIG env var to override config path

└──▷ GET THIS VERSION

$ git clone --branch v8.2.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.2.0

└──▷ USE IT

Run gitleaks against a directory using a custom config file instead of the default.

shell

gitleaks --config ./my-secrets.toml --source /path/to/repo

Use an environment variable to point gitleaks to a config file, taking precedence over local .gitleaks.toml.

shell

GITLEAKS_CONFIG=/etc/gitleaks/custom.toml gitleaks detect

Adds the --config (shorthand -c) CLI flag and GITLEAKS_CONFIG environment variable as the highest-precedence mechanisms for specifying a custom configuration file path, preceding .gitleaks.toml. If none are provided, gitleaks falls back to using its built-in default config.
Removes the automatic writing of the default configuration file to disk when no config is explicitly specified.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!gitleaks no longer writes a default .gitleaks.toml file if one is not present and no config path is provided.

v8.1.0 Dec 3, 2021 · release notes

Adds secretGroup to rule definitions for extracting specific secret substrings in reports.

└──▷ GET THIS VERSION

$ git clone --branch v8.1.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.1.0

Adds secretGroup to extract the actual secrets from the rules
Deduplicate generic secret findings in reports (provider specific rules takes precedence)
Renames Context to Match in reports

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Removes entropyGroup, so you will have to update your config again
!The Context field is renamed to Match in reports

v8.0.0 Nov 22, 2021 · release notes

gitleaks v8.0.0 adds detect/protect subcommands, multiline regex rules, and reduced memory via git log

└──▷ GET THIS VERSION

$ git clone --branch v8.0.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.0.0

└──▷ USE IT

Scan a local repository for secrets using the new subcommand structure.

shell

gitleaks detect --source=/path/to/repo

Write findings to stdout for piping into jq, while keeping logs separate on stderr.

shell

gitleaks detect -v --source=. | jq '.[].RuleID'

Adds detect and protect subcommands to replace the previous single-command interface.
Supports multiline regular expressions in rule definitions for more complex pattern matching.
Reduces memory usage from ~54MB to ~8.5MB on typical repos by shelling out git log -p instead of using go-git.
Includes RuleID, StartLine, EndLine, StartColumn, and EndColumn fields in finding reports.
Adds 60+ new detection rules to align with GitHub's secret scanning coverage.

+1 more show less

Moves all log messages to stderr and verbose findings output (-v/--verbose) to stdout for easier piping.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!The clone subcommand has been removed; users must clone repositories externally before scanning.
!The commit options and files at commit support have been removed; use git checkout or pass options via --log-opts.

v7.6.0 Sep 4, 2021 · release notes

gitleaks v7.6.0 adds ruleid field to SARIF output and uses embed for default config

└──▷ GET THIS VERSION

$ git clone --branch v7.6.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v7.6.0

Uses Go embed package to load the default gitleaks configuration

1 detail in Everything

v7.5.0 May 5, 2021 · release notes

Adds offender entropy to reports and pre-commit hook support.

└──▷ GET THIS VERSION

$ git clone --branch v7.5.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v7.5.0

└──▷ TRY IT

Scan a repository and output results including entropy metrics for high-entropy secrets.

$ gitleaks detect --no-git

Configure pre-commit to run gitleaks on staged files.

📍# Add to .pre-commit-config.yaml repos: - repo: https://github.com/gitleaks/gitleaks rev: v7.5.0 hooks: - id: gitleaks

Includes offenderEntropy in the report output

1 detail in Everything

v7.3.0 Mar 5, 2021 · release notes

gitleaks v7.3.0 adds support for appending repo and user configurations to extend the scan setup.

└──▷ GET THIS VERSION

$ git clone --branch v7.3.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v7.3.0

└──▷ TRY IT

Merge a custom repo config into your scan by appending it to the main config file

$ gitleaks detect --config .gitleaks.toml --repo-config ./custom-repo-config.yaml

Adds ability to append repository configurations and user-supplied configurations to the specified or default configuration file.

1 detail in Everything

v7.2.0 Dec 12, 2020 · release notes

gitleaks v7.2.0 adds a -q/--quiet flag for JSON-only logging

└──▷ GET THIS VERSION

$ git clone --branch v7.2.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v7.2.0

└──▷ TRY IT

Run a scan and suppress all non-JSON output to CI logs.

$ gitleaks detect -q --log-format json

v7.1.0 Dec 8, 2020 · release notes

Adds --leaks-exit-code flag to control exit code; speeds up scans via concurrent patch generation.

└──▷ GET THIS VERSION

$ git clone --branch v7.1.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v7.1.0

└──▷ USE IT

Customize the exit code to trigger different CI pipeline steps based on leak count.

shell

gitleaks --repo=https://github.com/example/repo --leaks-exit-code=2

Adds --leaks-exit-code flag to set the exit code when leaks are found (default: 1)
Enables concurrent patch generation for significantly faster scan performance

2 details in Everything

v7.0.2 Dec 5, 2020 · release notes

gitleaks v7.0.2 adds rule/allowlist functions to the Config package for integration.

└──▷ GET THIS VERSION

$ git clone --branch v7.0.2 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v7.0.2

--no-git scans .git directory, finds false positives https://github.com/zricethezav/gitleaks/issues/474
--path + --repo-config-path + --no-git = segmentation violation https://github.com/zricethezav/gitleaks/issues/473

2 details in Everything

v7.0.0 Dec 2, 2020 · release notes

Gitleaks v7.0.0 introduces --no-git for non-repo scanning, new exit codes, and API removal

└──▷ GET THIS VERSION

$ git clone --branch v7.0.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v7.0.0

Adds --no-git flag to scan directories or files without requiring a git repository
Adds support for threaded execution when using the --no-git flag for faster scans
Adds new exit code semantics: exit code 1 indicates an error occurred during execution
Removes direct GitHub and GitLab API scanning capabilities, including the --hosts option

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The --hosts flag is removed; gitleaks no longer scans groups, projects, owners, users, or PRs/MRs via GitHub/GitLab APIs.
!The --pretty option is removed; pretty printing leaks is now the default behavior.

v6.1.0 Aug 31, 2020 · release notes

Adds --commits and --commits-file flags for precise commit-range scanning in gitleaks v6.1.0

└──▷ GET THIS VERSION

$ git clone --branch v6.1.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v6.1.0

└──▷ TRY IT

Scan only two specific commits for secrets without scanning their history.

$ gitleaks --commits=<commit_hash_a>,<commit_hash_b>

Scan a list of commits defined in an external file for targeted auditing.

$ gitleaks --commits-file=/path/to/commits.txt

Adds --commits CLI argument to scan specific commits (comma-separated)
Adds --commits-file CLI argument to scan commits listed in a file

2 details in Everything

v6.0.0 Aug 12, 2020 · release notes

gitleaks v6.0.0 adds SARIF report output and per-rule allowlist support

└──▷ GET THIS VERSION

$ git clone --branch v6.0.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v6.0.0

Adds --report-format=sarif flag to output findings in SARIF schema format
Adds regexes array to global [allowlist] section in config
Renames per-rule [[rules.allowlist]] to [rules.allowlist] and file/path to files/paths

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Per-rule [rules.allowlist] is now a single table instead of an array of tables; use [rules.allowlist] not [[rules.allowlist]]
!Per-rule allowlist keys file and path renamed to files and paths respectively

v5.0.0 Jul 24, 2020 · release notes

v5.0.0 adds line numbers to reports, switches default scan to git additions only, and introduces the --include-deletion flag.

└──▷ GET THIS VERSION

$ git clone --branch v5.0.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v5.0.0

└──▷ USE IT

Scan both additions and deletions in a repository, outputting results with line numbers.

shell

gitleaks detect --source . --include-deletion

Update a gitleaks configuration file to use the new allowlist key instead of the deprecated whitelist.

config

allowlist = [ ... ]

Adds --include-deletion flag to allow scanning deletions in addition to additions
Adds line numbers to leak reports for more precise leak location identification
Changes default scan scope to git additions only, excluding deletions from the default run

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The whitelist config key is renamed to allowlist; existing custom configs must be updated to use allowlist.

v4.3.0 May 31, 2020 · release notes

Adds --commit-since and --commit-until CLI flags to audit commits by date range

└──▷ GET THIS VERSION

$ git clone --branch v4.3.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v4.3.0

└──▷ TRY IT

Audit only the last month of commits for secrets.

$ gitleaks detect --commit-since='2023-10-01' --commit-until='2023-11-01'

Adds --commit-since= flag to audit commits more recent than a specific date
Adds --commit-until= flag to audit commits older than a specific date

2 details in Everything

v4.2.0 May 9, 2020 · release notes

Add whitelist support to detect rules for excluding specific repositories from scanning

└──▷ GET THIS VERSION

$ git clone --branch v4.2.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v4.2.0

Adds whitelist section with repos field to .gitleaksrules config to exclude specific repositories from detection

1 detail in Everything

v4.1.0 Mar 3, 2020 · release notes

Adds --files-at-commit=latest to scan the current HEAD without specifying a commit hash

└──▷ GET THIS VERSION

$ git clone --branch v4.1.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v4.1.0

└──▷ USE IT

Scan the entire repository at its current HEAD without manually looking up or typing the commit hash.

shell

gitleaks detect --source . --files-at-commit=latest

Adds --files-at-commit=latest subcommand argument to use the latest commit state for scanning

1 detail in Everything

v4.0.0 Feb 27, 2020 · release notes

Gitleaks v4.0.0 adds GitHub Action, enhanced entropy scanning, and path-based regex filtering

└──▷ GET THIS VERSION

$ git clone --branch v4.0.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v4.0.0

└──▷ HOW TO FIND IT

Scan PRs and commits using the new GitHub Action

📍steps: In your workflow YAML, add uses: gitleaks/gitleaks-action@v4

Adds gitleaks GitHub Action for CI/CD integration
Enhances entropy detection engine to improve secret identification accuracy

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The Global table is removed from the config file; use rules instead.

v3.3.0 Feb 1, 2020 · release notes

Adds --files-at-commit= to scan all files at a specific commit

└──▷ GET THIS VERSION

$ git clone --branch v3.3.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v3.3.0

└──▷ USE IT

Scan every file in the repository as it existed at a specific historical commit.

shell

gitleaks detect --source=. --files-at-commit=<commit-hash>

v3.2.0 Jan 19, 2020 · release notes

gitleaks v3.2.0 adds timeout, depth, and exclude-forks options for audit scans

└──▷ GET THIS VERSION

$ git clone --branch v3.2.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v3.2.0

└──▷ TRY IT

Limit an audit operation to 5 minutes to prevent hanging on slow repositories.

$ gitleaks audit --timeout 300

Skip forks when auditing a GitHub organization to focus only on official repos.

$ gitleaks audit --github org:myorg --exclude-forks

Adds timeout option to control audit operation timeouts.
Adds depth option to set audit depth limits.
Adds exclude-forks option to skip forked repositories during GitHub/GitLab audits.

3 details in Everything

v3.1.0 Jan 12, 2020 · release notes

gitleaks v3.1.0 adds commit-from and commit-to CLI flags to scan specific commit ranges

└──▷ GET THIS VERSION

$ git clone --branch v3.1.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v3.1.0

└──▷ USE IT

Scan the last 50 commits in a repository for secrets.

shell

gitleaks --repo . --commit-from=$(git rev-list -n 50 HEAD | tail -1)

Audit secrets between two specific commit hashes.

shell

gitleaks --repo . --commit-from=a0f72a4e3595ddb382a77804d2674d54b2b0e880 --commit-to=454acebe5ac5961d3acefe96e430d205a19f550c

Adds commit-from flag to start scanning from a specified commit
Adds commit-to flag to stop scanning at a specified commit

2 details in Everything

v3.0.3 Nov 30, 2019 · release notes

gitleaks v3.0.3 adds staged changes support with --repo-config and ignores gitleaks.toml by default

└──▷ GET THIS VERSION

$ git clone --branch v3.0.3 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v3.0.3

└──▷ USE IT

Scan local uncommitted changes using the repository's specific gitleaks configuration.

shell

gitleaks detect --repo-config .gitleaks.toml --staged

Honors the --repo-config flag when scanning staged, uncommitted changes
Ignores gitleaks.toml files in default detection rules

2 details in Everything

v3.0.1 Nov 17, 2019 · release notes

gitleaks v3.0.1 adds --report-format flag and example leaky-repo config

└──▷ GET THIS VERSION

$ git clone --branch v3.0.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v3.0.1

└──▷ TRY IT

Export findings to CSV instead of the default JSON format.

$ gitleaks detect --report-format csv

Adds --report-format CLI argument to control export format (json or csv)
Adds example configuration for hitting a decent score on the leaky-repo repository

2 details in Everything

v3.0.0 Nov 15, 2019 · release notes

gitleaks v3.0.0 adds pre-commit scanning support, whitelists per rule, and debug regex timing via CLI flags

└──▷ GET THIS VERSION

$ git clone --branch v3.0.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v3.0.0

└──▷ USE IT

Authenticate to a private repository with credentials supplied directly on the command line

shell

gitleaks --username <user> --password <pass> --repo <repo_url>

Profile rule performance by inspecting which regular expressions are slowest during a scan

shell

gitleaks --debug ./my-repo

Adds --username and --password CLI arguments to enable username/password authentication for git clone operations
Adds --debug flag to output individual regex performance times during scanning
Enables per-rule whitelists in rule definitions to exclude specific matches

3 details in Everything

v2.1.0 Aug 1, 2019 · release notes

Gitleaks v2.1.0 adds Gitlab token support, --repo-config for orgs/users, and proper exit codes.

└──▷ GET THIS VERSION

$ git clone --branch v2.1.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v2.1.0

--commit flag now directly accesses the commit object instead of iterating on history
--repo-config option works on organizations and users in addition to repos
Added Gitlab Token support for authentication
Proper exit codes are returned on completion

4 details in Everything

v2.0.0 Apr 17, 2019 · release notes

gitleaks v2.0.0 replaces regexes with a new [[rules]] block using regex, entropy, and file matching.

└──▷ GET THIS VERSION

$ git clone --branch v2.0.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v2.0.0

Introduces [[rules]] section to gitleaks.toml replacing [[regexes]] to define detections combining regex, entropy ranges, and file type filters.

1 detail in Everything

└──▷ BREAKING ON UPGRADE

![[regexes]] in gitleaks.toml is removed; configuration must migrate to [[rules]] blocks.

v1.25.0 Mar 30, 2019 · release notes

Adds --branch flag for Git branch scanning

└──▷ GET THIS VERSION

$ git clone --branch v1.25.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v1.25.0

└──▷ USE IT

Scan commits from a specific branch rather than the full history

shell

gitleaks detect --source . --branch feature/new-auth

v1.24.0 Feb 7, 2019 · release notes

gitleaks v1.24.0 adds --commit and --commit-stop flags to target specific commits for auditing

└──▷ GET THIS VERSION

$ git clone --branch v1.24.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v1.24.0

Adds --commit flag to audit a specific commit instead of the default range
Adds --commit-stop flag to limit auditing up to and including a specified commit

2 details in Everything

v1.23.0 Jan 7, 2019 · release notes

Adds --repo-config flag for per-repository configuration in v1.23.0

└──▷ GET THIS VERSION

$ git clone --branch v1.23.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v1.23.0

└──▷ TRY IT

Use a custom detection rule set for a specific monorepo directory without changing the global default config.

$ gitleaks detect --source . --repo-config ./my-repo/gitleaks.toml

Introduces the --repo-config CLI argument to load configurations specific to a repository target

1 detail in Everything

v1.22.0 Dec 10, 2018 · release notes

Adds --noise-reduction flag and context inclusion for redactions

└──▷ GET THIS VERSION

$ git clone --branch v1.22.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v1.22.0

└──▷ USE IT

Reduce false positives from entropy-based detection during a scan.

shell

gitleaks detect --noise-reduction /path/to/code

Adds --noise-reduction option to reduce noise from entropy signals

1 detail in Everything

v1.13.0 Oct 20, 2018 · release notes

Adds --github-pr flag to audit GitHub Pull Requests without cloning the full repository

└──▷ GET THIS VERSION

$ git clone --branch v1.13.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v1.13.0

└──▷ USE IT

Scan a specific GitHub pull request in CI without cloning the repo

shell

docker run --rm --name=gitleaks -e GITHUB_TOKEN=${GITHUB_TOKEN} zricethezav/gitleaks:v1.13.0 --github-pr=https://github.com/owner/repo/pull/9000

Adds support for the --github-pr CLI flag and GITHUB_TOKEN environment variable to scan PRs directly via Docker

1 detail in Everything

v1.6.0 Oct 2, 2018 · release notes

Gitleaks v1.6.0 adds auto-threading and --disk cleanup for org audits

└──▷ GET THIS VERSION

$ git clone --branch v1.6.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v1.6.0

Automatically sets default go-routines to match available CPU cores (derived from GOMAXPROCS/2), optimizing scan performance without manual configuration
Deletes individual repositories from disk immediately after they are audited when using the --disk flag, preventing disk space exhaustion during large org audits

2 details in Everything

v1.5.0 Sep 30, 2018 · release notes

Adds --csv flag to output findings as CSV reports

└──▷ GET THIS VERSION

$ git clone --branch v1.5.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v1.5.0

└──▷ USE IT

Scan a GitHub repository and export results directly to CSV for downstream analysis.

shell

gitleaks --github-user=gitleakstest --report="report.csv" --csv

v1.0.0 Jul 21, 2018 · release notes

Gitleaks v1.0.0 adds --in-memory processing, whitelist support via config, and --max-go concurrency control

└──▷ GET THIS VERSION

$ git clone --branch v1.0.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v1.0.0

└──▷ USE IT

Process a repository in memory with custom whitelist rules for commits and file types, limiting concurrency.

shell

gitleaks --repo=https://github.com/example/repo --in-memory --config=./gitleaks.toml --max-go=4

Configuration file to whitelist specific commits and file patterns, ignoring default regexes.

toml

[whitelists]
files = [
  "(.*?)(jpg|gif|doc|pdf|bin)$"
]
commits = [
  "cb5599aeed261b2c038aa4729e2d53ca050a4988"
]

Audit all git references in a repository using external config and memory processing.

shell

gitleaks --repo=https://github.com/example/repo --all-refs --in-memory --config=./gitleaks.toml

Adds --in-memory flag to process git repositories in memory instead of shelling out to git commands for performance gains
Adds GITLEAKS_CONFIG environment variable and --config= CLI argument to support external TOML configuration files
Adds [whitelists] table with files, commits, branch, and regex arrays in config to skip specific scans without code changes
Adds --max-go flag to control the maximum number of concurrent goroutines per repository
Adds --all-refs flag to audit all git references instead of only origin/HEAD

5 details in Everything

gitleaks

Summary

How gitleaks helps

Languages

Features

What gitleaks offers you

release 14 total

docs

we ran it 10 total

example

release 22 total

release 17 total

example

release 9 total

example

release 10 total

example

release 7 total

example

release

example

release

example

release

example

release

example

release

example

release

example

release

example

release

example

release

command line

example

release

example

release

example

command line

example

release

release

example

release

example

release

example

release

example

release

example

release

example

release

example

release

example

release

release

release

release

release

release

release

release

command line

release

release

release

release

release

example

release

example

release

release