gitleaks — The Cyber Toolchain

gitleaks v8.30.0

Wed, 26 Nov 2025 16:31:23 GMT

gitleaks v8.30.0 adds Looker client ID/secret and Airtable Personal Access Token detection rules • Adds detection rules for Looker client ID and client secret credentials. • Adds detection rule for Airtable Personal Access Tokens. • Documents recursive decoding behavior (0 to 5 levels) for encoded secret detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.29.0

Tue, 04 Nov 2025 21:42:27 GMT

Gitleaks v8.29.0 adds Amazon Bedrock API key detection, improved Sonar token regex, config min version enforcement, and trace logging for skipped archives. • Adds detection rule for Amazon Bedrock API keys. • Improves Sonar token detection regex to match tokens with prefixes. • Adds `min-version` enforcement in config files to require a minimum Gitleaks version. • Adds trace-level logging when archive files are skipped because archive scanning is not enabled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.28.0

Sun, 20 Jul 2025 16:18:38 GMT

gitleaks v8.28.0 adds composite (multi-part) rules with proximity matching, Anthropic and Artifactory secret detections, and allowlist optimizations. • Adds composite rules (`[[rules.required]]`) that let a primary rule report a finding only when one or more auxiliary rules also match, with optional `withinLines` and `withinColumns` proximity constraints. • Supports fragment-level, line-bounded, column-bounded, and combined line+column proximity matching for composite rules. • Adds built-in detection for Anthropic API keys. • Adds built-in detection for Artifactory reference tokens and API keys. • Promotes allowlist stopword optimizations for faster scanning. • Defers newline calculation in fragments until a rule match occurs, significantly reducing scan time on large repositories. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.27.1

Sun, 08 Jun 2025 01:59:23 GMT

gitleaks v8.27.1 adds Heroku API key detection and new Bitbucket/Gitea platform support • Adds detection rule for the new Heroku API Key format (new version pattern). • Adds Bitbucket as a supported platform for secret scanning. • Adds Gitea as a supported platform for secret scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.27.0

Sun, 01 Jun 2025 16:36:05 GMT

Gitleaks v8.27.0 adds recursive archive scanning to detect secrets inside zip files, tarballs, and nested archives. • Adds `--max-archive-depth` flag to enable automatic extraction and scanning of archive files (zip, tar, etc.) during `dir` and `git` scan types. • Supports recursive archive scanning so secrets nested inside archives-within-archives are discovered up to the configured depth limit. • Reports archive-contained findings with `!`-separated inner paths (e.g., `nested.tar.gz!inner.tar!files/.env.prod`) for precise location tracking. • Adds diagnostics output for improved visibility into scan behavior. • Adds Unicode decoding support for broader file content handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.26.0

Mon, 12 May 2025 21:03:12 GMT

Gitleaks v8.26.0 adds percent/URL decoding, slow-file identification, and 1Password secret key detection. • Adds percent/URL decoding support alongside existing hex and base64 decoders, enabled via `--max-decode-depth`. • New slow-file identification surfaces files that are causing performance bottlenecks during scanning. • Adds built-in detection rule for 1Password secret keys. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.25.0

Tue, 29 Apr 2025 14:53:48 GMT

Gitleaks v8.25.0 adds multi-global-allowlist support, Perplexity AI and ClickHouse secret detection, and higher GCP entropy rules. • Supports defining multiple global allowlists in config, enabling layered suppression strategies across rule sets. • Adds detection rule for Perplexity AI API keys. • Adds detection rule for ClickHouse credentials. • Increases entropy threshold for GCP rules to reduce false positives while sharpening true detections. • Validates and sorts rules automatically when generating rule configs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.24.3

Fri, 11 Apr 2025 14:27:15 GMT

Gitleaks v8.24.3 adds GitLab Runner, Azure DevOps, MaxMind, OpenAI, and Slack Triggers detections plus env-var config support. • Adds detection rule for GitLab Runner Tokens (Routable). • Adds detection rule for MaxMind license keys. • Adds updated regex pattern for OpenAI API keys. • Adds detection rule for Slack Workflow trigger URLs (hooks.slack.com/triggers/). • Adds Azure DevOps platform support in SCM detection and source-link generation. • Enables setting the full Gitleaks config via the `GITLEAKS_CONFIG_TOML` environment variable (inline TOML content, no file required). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.24.2

Sat, 22 Mar 2025 12:08:54 GMT

gitleaks v8.24.2 adds report-format inference from file extension and makes go-re2 opt-in • Infers `--report-format` automatically from the `--report-path` file extension when no format is explicitly provided. • Switches to standard Go regexp by default; go-re2 is now opt-in via a separate build tag. Breaking changes: • go-re2 is no longer the default regexp engine; builds that relied on go-re2 behavior by default must now explicitly opt in. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.24.0

Thu, 20 Feb 2025 02:11:45 GMT

Gitleaks v8.24.0 adds Sonar, Sourcegraph, and .p12 file rules plus streaming DetectReader support and a new git link-generation toggle. • New Sonar secret detection rule. • New Sourcegraph token detection rule. • New rule to detect secrets in `.p12` files. • Adds streaming support via `DetectReader`, enabling detection on streamed input without buffering the entire source. • Adds `deno.lock` to default path exclusions, reducing noise in Deno projects. • Paths and fingerprints are now computed in a platform-agnostic way, making results consistent across Windows and Unix. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.23.3

Wed, 29 Jan 2025 14:46:14 GMT

Gitleaks v8.23.3 enhances the curl-auth-user rule to catch empty usernames or passwords. • Enhances `curl-auth-user` detection to flag empty usernames or passwords in curl credentials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.23.2

Fri, 24 Jan 2025 14:25:35 GMT

Gitleaks v8.23.2 adds base64 API key detection, Cisco Meraki rule, git link reporting, and password redaction in remote URLs. • Detects base64-encoded secrets with the updated `generic-api-key` rule. • New detection rule for Cisco Meraki API keys. • Adds a Facebook keyword for secret detection. • Includes a source link in the report output for each finding. • Redacts passwords from remote URLs in git operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.23.1

Wed, 15 Jan 2025 12:51:08 GMT

Gitleaks v8.23.1 adds the ability to disable extended rules via config. • Supports disabling individual extended rules in config, giving teams fine-grained control over which inherited rules are active. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.23.0

Mon, 13 Jan 2025 15:04:20 GMT

Gitleaks v8.23.0 lets rules define multiple allowlists with AND/OR conditions to cut false positives • Supports multiple `[[rules.allowlists]]` blocks per rule, so a finding is suppressed when ANY listed allowlist matches. • Adds `condition` field (`OR` / `AND`) to allowlist blocks, enabling precise control — OR to match any criterion, AND to require all criteria simultaneously. • Adds `regexTarget` field (`secret`, `match`, or `line`) to allowlist blocks, letting you apply regex checks against the full match or entire line instead of just the extracted secret. • Adds comma as a valid operator in `GenerateSemiGenericRegex`, broadening auto-generated pattern coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.22.1

Mon, 30 Dec 2024 16:25:05 GMT

Gitleaks v8.22.1 adds entropy tracing to help explain why a secret triggered a detection. • Adds entropy trace output to detection results, surfacing the entropy calculation that contributed to a finding. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.22.0

Fri, 20 Dec 2024 16:12:19 GMT

Gitleaks v8.22.0 replaces Go's regex engine with go-re2, delivering 2–4× faster secret scanning. • Replaces the standard library regex engine with go-re2, achieving 2–4× scanning speedup — unlocking practical use on large repos and CI pipelines where scan time was previously prohibitive. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.21.3

Thu, 19 Dec 2024 20:38:30 GMT

Gitleaks v8.21.3 adds new secret detections, user-defined report templates, line numbers in reports, and STDOUT output support. • Adds SettleMint API key detection. • Adds GitLab routable token detection. • Adds Freemius secret key detection. • Adds Sentry.io token detection for the new token format. • Adds new Jira API token pattern detection. • Supports user-defined report templates via custom template files. • Outputs report to STDOUT when no report file is specified, enabling pipeline-friendly usage. • Adds optional `Line` field inclusion in reports for precise finding location. • Improves directory scan chunking for better performance scanning large files. • Continues directory scans on permission errors instead of halting. • Updates global and generic allowlist rules. • Adds human-readable descriptions for curl rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.21.2

Mon, 28 Oct 2024 13:32:54 GMT

Gitleaks v8.21.2 adds Octopus Deploy, 1Password, and new GitLab token rules plus curl header detection. • Adds detection rule for Octopus Deploy API keys. • Adds detection rules for new GitLab token formats. • Adds detection rule for 1Password tokens. • Adds curl header rule to catch secrets passed via HTTP headers. • Expands AWS access token rule with entropy checks and an allowlist. • Tunes generic-api-key rule with additional entropy filtering and keyword exclusions to reduce false positives. • Updates global allowlist to suppress common false-positive paths and patterns. • Adds automatic ignoring of jQuery and Swagger-UI static assets to reduce noise in web projects. • Bumps Okta token entropy threshold to 4 for higher-confidence detections. • Adds identifier left-side matching to broaden secret context detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.21.1

Fri, 18 Oct 2024 11:37:06 GMT

Gitleaks v8.21.1 adds a built-in detection rule for curl basic auth credentials. • Adds built-in rule to detect curl basic auth credentials hardcoded in source or history. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.21.0

Tue, 15 Oct 2024 02:13:58 GMT

Gitleaks v8.21.0 adds multiple allowlists per rule and a new Azure AD client secret detector. • Supports defining multiple allowlists per rule, enabling finer-grained suppression logic within a single rule definition. • Adds detection for Azure AD client secrets. • Matches `gitleaks.toml` config file anywhere in the directory tree, not just the repo root. Breaking changes: • Findings previously suppressed via `.gitleaksignore` may reappear: gitleaks now records the correct commit SHA where a secret was introduced instead of the merge commit SHA, so existing ignore-list entries keyed to merge commit SHAs will no longer match. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.20.1

Mon, 07 Oct 2024 16:56:54 GMT

Gitleaks v8.20.1 adds PrivateAI, Cohere, and NuGet config password rules plus global allowlist placeholder regexes. • Adds PrivateAI secret detection rule to catch PrivateAI API keys in repos. • Adds Cohere secret detection rule to identify Cohere API keys. • Adds NuGet config password rule to detect credentials in NuGet configuration files. • Supports placeholder regexes in the global allowlist, enabling broad suppression of known-safe patterns across all rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.20.0

Thu, 03 Oct 2024 15:06:56 GMT

Gitleaks v8.20.0 adds automatic Base64 decoding to uncover secrets hidden in encoded text. • Adds `--max-decode-depth` flag to enable automatic detection and decoding of Base64-encoded (standard and base64url) content during scans. • Supports recursive decoding so secrets nested inside multiply-encoded strings are also surfaced. • Tags findings from encoded content with `decoded:` and `decode-depth:` for easy filtering. • Prints rule tags in findings output when tags are present. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.19.3

Thu, 26 Sep 2024 14:22:39 GMT

Gitleaks v8.19.3 adds a Fly.io secret rule, comment support in .gitleaksignore, and sharpened GCP/GitHub detections. • Adds a new built-in detection rule for Fly.io secrets. • Supports comment strings in `.gitleaksignore` files, making ignore lists self-documenting. • Adds entropy scoring to the GitHub token detection rule to reduce noise. • Updates the GCP API key rule with improved detection logic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.19.0

Sat, 14 Sep 2024 00:46:13 GMT

Gitleaks v8.19.0 adds new `git`, `dir`, and `stdin` commands plus Kubernetes and OpenShift secret detection rules. • Adds new top-level `git`, `dir`, and `stdin` subcommands as the modern replacements for `detect` and `protect`. • New detection rule for Kubernetes secrets. • New detection rule for OpenShift user tokens. • New detection rules for Harness Personal Access Tokens (PAT) and Service Account Tokens (SAT). • Makes config generation utilities public for programmatic use. • Adds `poetry.lock`, `gradle verification-metadata.xml`, `go.work`, and `go.work.sum` to the global allowlist paths. • Uses the first non-empty capture group when `secretGroup` is not set, reducing required rule configuration. • Updated rule validation now uses rule ID in config validation errors for clearer feedback. Breaking changes: • The `detect` and `protect` subcommands are deprecated in favor of `git`, `dir`, and `stdin`; the change is intended to be backwards compatible but may break existing scripts or tooling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.18.4

Fri, 14 Jun 2024 15:38:27 GMT

New detections for NewRelic insert key and intra42 client secret • Adds support for detecting NewRelic insert keys • Adds support for detecting intra42 client secrets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.18.3

Sat, 01 Jun 2024 13:45:59 GMT

New detections for Facebook access tokens, Cloudflare API keys, Square update tokens, and ordered rule extension logic. • Adds detection rules for Facebook access tokens and page access tokens • Adds detection rules for Cloudflare API and Origin CA keys • Adds detection rule for Square update tokens • Adds `mailchimp` token patterns to existing detection coverage • Extends FB access token discovery capabilities • Changes rule loading behavior by appending ordered rules when extending configurations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.18.2

Thu, 01 Feb 2024 17:08:03 GMT

gitleaks v8.18.2 adds pre-commit hook support and extends --max-target-megabytes to --no-git mode • Extends `--max-target-megabytes` flag to work with `--no-git` flag for scanning arbitrary directories without git history. Breaking changes: • `protect` and `detect` are now merged into one command (likely `gitleaks protect` or similar unified entry point). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.18.1

Fri, 17 Nov 2023 20:58:58 GMT

New --ignore-gitleaks-allow flag, per-rule selection, optional case insensitivity, and new detection rules for Hugging Face and Scalingo. • Adds `--ignore-gitleaks-allow` CLI flag to bypass allowlist entries during scans • Enables selection of a single rule via the new rule filtering mechanism (#1183) • Makes case insensitivity optional for rule detection patterns (#1215) • Adds detection for Hugging Face access tokens (#1204) • Adds detection for Scalingo API Token (#1262) • Enables detection of base64-encoded JWTs (#1256) Breaking changes: • The `secretgroup` is removed from the default configuration file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.18.0

Tue, 22 Aug 2023 19:33:19 GMT

gitleaks v8.18.0 adds JFrog API/Identity key detection and entropy checks for Plaid secrets. • Adds JFrog API and Identity key detection rules to enable scanning for JFrog credentials in repositories • Adds entropy check to Plaid client/secret ID rules to reduce false positives when detecting Plaid secrets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.17.0

Thu, 15 Jun 2023 12:50:40 GMT

gitleaks v8.17.0 adds JUnit report format, tags for CSV/SARIF, and new token detections • Adds JUnit XML output format for scan results via the `--report-format=junit` flag • Adds `tags` field support in CSV and SARIF output formats • Adds detection rules for Snyk tokens, Makefile variables, and OpenAI API keys • Updates `generic-api-key` rule to ignore `REDACTED` in stopwords Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.16.3

Wed, 19 Apr 2023 17:32:08 GMT

Adds Authress access key and Defined Networking API token detection patterns • `Add Authress access key format` adds support for scanning Authress service client secrets. • `Add Defined Networking API Tokens` adds support for scanning Defined Networking API tokens. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.16.2

Thu, 30 Mar 2023 13:24:23 GMT

gitleaks v8.16.2 adds detection formats for Authress access keys and Defined Networking API Tokens • Adds `authress-access-key` format to detect Authress service client secrets. • Adds `defined-networking-api-token` format to detect Defined Networking API tokens. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.16.0

Sun, 26 Feb 2023 15:04:12 GMT

Adds `regexTarget` config key to `.gitleaks.toml` allowlist sections • Enables filtering findings based on context (the surrounding line) rather than just the extracted secret value. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.15.0

Thu, 13 Oct 2022 14:15:42 GMT

Adds `--pipe` and `--follow-symlinks` flags for new scanning workflows • Adds `--pipe` flag to detect secrets from standard input. • Adds `--follow-symlinks` flag to traverse symbolic links during scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.14.0

Mon, 10 Oct 2022 21:14:35 GMT

Adds `--max-target-megabytes` flag to limit scan file size and new detection rules for DigitalOcean tokens and Slack Workflow Webhooks. • Add `--max-target-megabytes` flag to set maximum file/blob size for scanning • Detect Slack Workflow Webhook URLs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.13.0

Thu, 22 Sep 2022 01:04:09 GMT

gitleaks v8.13.0 adds `--quiet` flag, Telegram detection, baseline support • Adds `--quiet` flag to silence the banner output for cleaner CLI usage. • Adds new detection rule for Microsoft Teams webhooks secret format. • Adds `baseline` configuration option to ignore previously known findings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.12.0

Sun, 04 Sep 2022 14:13:02 GMT

Adds `fingerprint` field to output and enables pretty-printed formatting for results • Adds `fingerprint` field to detection output • Introduces prettified output format by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.10.0

Sun, 07 Aug 2022 18:51:44 GMT

Adds `gitleaksignore` directive to ignore findings and new detection rules for Vault tokens and Sidekiq secrets • Introduces the `# gitleaksignore` comment directive to exclude specific lines from scanning results • Adds a new detection rule for JSON Web Tokens (JWT) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.9.0

Wed, 27 Jul 2022 23:30:43 GMT

Adds `extend` config section to support chaining configuration files. • Adds `[extend]` config section with `useDefault = true` and `path` keys to extend base gitleaks configurations • Allows extension chains up to a depth of 2 via the new `[extend]` config Breaking changes: • `useDefault` and `path` cannot be used together in the `[extend]` section; previously neither existed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.8.5

Wed, 25 May 2022 13:22:03 GMT

gitleaks v8.8.5 adds native Algolia key detection support. • Improves PlanetScale token detection accuracy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.2.0

Thu, 09 Dec 2021 15:26:23 GMT

Add `--config` flag and `GITLEAKS_CONFIG` env var to override config path • Adds the `--config` (shorthand `-c`) CLI flag and `GITLEAKS_CONFIG` environment variable as the highest-precedence mechanisms for specifying a custom configuration file path, preceding `.gitleaks.toml`. If none are provided, gitleaks falls back to using its built-in default config. • Removes the automatic writing of the default configuration file to disk when no config is explicitly specified. Breaking changes: • gitleaks no longer writes a default `.gitleaks.toml` file if one is not present and no config path is provided. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.1.0

Fri, 03 Dec 2021 02:07:56 GMT

Adds `secretGroup` to rule definitions for extracting specific secret substrings in reports. • Adds `secretGroup` to extract the actual secrets from the rules • Deduplicate generic secret findings in reports (provider specific rules takes precedence) • Renames `Context` to `Match` in reports Breaking changes: • Removes `entropyGroup`, so you will have to update your config again • The `Context` field is renamed to `Match` in reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks

gitleaks v8.0.0

Mon, 22 Nov 2021 18:20:33 GMT

gitleaks v8.0.0 adds detect/protect subcommands, multiline regex rules, and reduced memory via git log • Adds `detect` and `protect` subcommands to replace the previous single-command interface. • Supports multiline regular expressions in rule definitions for more complex pattern matching. • Reduces memory usage from ~54MB to ~8.5MB on typical repos by shelling out `git log -p` instead of using go-git. • Includes `RuleID`, `StartLine`, `EndLine`, `StartColumn`, and `EndColumn` fields in finding reports. • Adds 60+ new detection rules to align with GitHub's secret scanning coverage. • Moves all log messages to stderr and verbose findings output (`-v`/`--verbose`) to stdout for easier piping. Breaking changes: • The `clone` subcommand has been removed; users must clone repositories externally before scanning. • The `commit` options and `files at commit` support have been removed; use `git checkout` or pass options via `--log-opts`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitleaks