Secure · Secrets detection
Gitleaks
Gitleaks scans commits, branches and directories for credentials using regex and entropy rules. Runs in pre-commit hooks and CI, with SARIF/JSON reporting and fingerprint-based ignores.
On this page
What it does
Scans Git history (gitleaks git) or a directory (gitleaks dir) for secrets using an extensible TOML ruleset. Findings carry a fingerprint
that can be allowlisted in .gitleaksignore.
Where it fits
Secure stage, but its best location is the developer’s machine as a pre-commit hook, backed by a CI job on merge requests and a nightly full-history scan.
Quick start
gitleaks git --redact --exit-code 1 --report-format sarif --report-path gitleaks.sarif .
gitleaks dir --redact .Common pitfalls
- Forgetting
--redactturns the CI log into a second leak. - Shallow CI clones (
GIT_DEPTH: 1) scan almost nothing ingitmode. - Allowlisting whole directories to silence noise; allowlist lockfiles and fixtures by path instead.
On this site
- Secrets and Configuration Security: where secret detection fits in the lifecycle, and what Gitleaks and Trivy both missed in a build context (a random database password with no keyword).
Hands-on labs using Gitleaks
Scan Git Repositories with Gitleaks
Seed a repository with realistic fake secrets, catch them with Gitleaks in history and working-tree modes, ignore a confirmed false positive by fingerprint, and block the next one at commit time.
Articles about Gitleaks
Reusable GitLab CI Templates and Components: A Golden Delivery Path
One platform-owned GitLab CI template instead of a pipeline per repository: spec:inputs with validation, a consumer that includes it by project and tag, extension points, versioning, and what a consumer can override.
Secrets and Configuration Security: Images, Kubernetes, Vault and Rotation
The secrets lifecycle for a cloud workload: credentials recovered from image history and deleted layers, a build that leaves nothing behind, Secrets in etcd before and after encryption at rest, rotation, and Vault TTLs.
A GitLab CI/CD Security Pipeline That Developers Do Not Route Around
The GitLab pipeline that gated this site while it ran CI: frozen installs, parallel quality gates, Trivy with SAST and secret detection, artifact verification, and one deployment owner behind protected main.
Secrets Detection with Gitleaks
Stop credentials from reaching Git: run Gitleaks in pre-commit hooks and CI, tune rules and allowlists, handle findings without leaking them further, and decide when history rewriting is worth it.
Building a Secure CI/CD Pipeline with Jenkins
A declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.