gitleaks v3.3 releases: Searches full repo history for secrets and keys
gitleaks – Check git repos for secrets and keys
Gitleaks provides a way for you to find unencrypted secrets and other unwanted data types in git source code repositories.
As part of its core functionality, it provides;
- Github support including support for the bulk organization and repository owner (user) repository scans, as well as pull request scanning for use in common CI workflows.
- Support for private repository scans, and repositories that require key-based authentication
- Output in CSV and JSON formats for consumption in other reporting tools and frameworks
- Externalised configuration for environment-specific customization including regex rules
- Customizable repository name, file type, commit ID, branchname and regex whitelisting to reduce false positives
- High performance through the use of src-d’s go-git framework
It has been successfully used in a number of different scenarios, including;
- Adhoc scans of local and remote repositories by filesystem path or clone URL
- Automated scans of github users and organizations (both public and enterprise platforms)
- As part of a CICD workflow to identify secrets before they make it deeper into your codebase
- As part of a wider secret auditing automation capability for git data in large environments
--files-at-commit=option scans ALL files in the repo at a specific commit.
- fixed a bug where
--commit=had the same behavior as
--files-at-commitin that it was scanning all the files, not the patch.
--commit=now scans only the patch. See #326 for more information