Gitleaks

Visit Website

Introduction

Gitleaks detects secrets like passwords, API keys and tokens in Git repositories, files and anything piped to it. It is one of the most popular secret scanners, with about 30,900 GitHub stars.

Important: the README now says Gitleaks is feature complete, no new features will be merged, future releases will be security patches only, and the author is shifting focus to a new project called Betterleaks.

The source code is at gitleaks/gitleaks on GitHub under the MIT licence, with about 30,900 stars; the most recent commit was on 28 October 2026.

Features

1. Git history scanning: Scan commits and history.
2. Directory and stdin: Scan files or piped input.
3. Configurable rules: TOML config with custom rules and allowlists.
4. Pre-commit hook: Stop secrets before commit.
5. Report formats: JSON, CSV, SARIF and more.

Pros

1. Free to use: Open source under MIT.
2. Maintained: Commits as recent as 28 October 2026.
3. Community: About 30,900 GitHub stars.

Cons

1. Feature frozen: Only security patches going forward.
2. No live verification: Does not check if secrets are active.

Usage and Links (Example)

gitleaks git -v .
gitleaks dir ./src

Resources:

• Gitleaks website
• GitHub repository

Pricing

Gitleaks is free and open source under the MIT licence.

Recommended for?

1. Teams wanting a simple, free secrets gate in CI or pre-commit.
2. Existing Gitleaks users (note the maintenance status).
3. Not a fit if you need live secret validation.

Conclusion

Gitleaks remains a solid, simple secret scanner, but plan for its security-patch-only status.