Skip to main content
hc
Submit
toolsSource-backed
Gitleaks logo

Gitleaks

Open-source secret scanner for finding passwords, API keys, tokens, and other credentials in git history, files, directories, and stdin.

by Gitleaks · submitted by oktofeesh1·added 2026-06-03·
CLI
HarnessCLI
Review first — review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Canonical URL
https://heyclau.de/entry/tools/gitleaks
Source URLs
https://github.com/gitleaks/gitleaks, https://gitleaks.io
Brand
Gitleaks
Brand domain
gitleaks.io
Brand asset source
brandfetch
Safety notes
Gitleaks can scan git history and large directories, so scope scans intentionally and use baselines for noisy legacy repositories., Findings may include real active credentials; treat reports, CI logs, and exported SARIF or JSON artifacts as sensitive., The upstream README states Gitleaks is feature complete and future releases are expected to be security patches only.
Privacy notes
Scans inspect repository contents, file contents, commit metadata, and streamed input for credential-like strings., Report files and verbose logs can contain secret values unless redaction and artifact retention are configured carefully., CI integrations may expose findings to workflow logs, code-scanning systems, or third-party build infrastructure.
Author
Gitleaks
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-03

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

78

Baseline

—

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Complete

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done

  • Source provenance statusRequired

    Marked as source-backed.

    Done

  • Metadata reviewed

    Registry metadata indicates a reviewed listing.

    Done

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done

  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done

  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done

  • Package verification flag

    No package verification flag provided.

    Pending

  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending

  • Baseline comparison available

    No baseline peer selected yet.

    Pending

  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

Copy & paste

Copy-ready — paste the snippet to get started.

Install command

Not provided

Config snippet

Not provided

Copy snippet

Provided

Prerequisites

3 to clear

Platforms

1 listed

Install type

Copy & paste

Adoption plan

Balanced adoption plan

Current risk score 16/100. Use staged verification before broader rollout.

Risk 16

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done

  • Confirm metadata review state

    Listing has review metadata.

    Done

  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done

  • Review privacy notesRequired

    Privacy notes are present.

    Done

  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending

  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending

  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Required evidence gates are covered (5/6 signals complete).

Risk 15

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Present

Review metadata is present.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required evidence gates are covered for this preset.

Decision timeline

Decision timeline · balanced

5/6 steps complete with no blocking gaps for this preset.

Risk 14

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is available.

Done

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

No required blockers for this timeline preset.

Prerequisite readiness

Prerequisite readiness

3 prerequisites to line up before setup. Have accounts and credentials ready first.

0/3 ready
Account & credentials1Install & runtime1Permissions & scopes1

Safety & privacy surface

Safety & privacy surface

3 safety and 3 privacy notes across 4 risk areas. Review closely: credentials & tokens, permissions & scopes, third-party handling.

4 areas
  • SafetyPermissions & scopesGitleaks can scan git history and large directories, so scope scans intentionally and use baselines for noisy legacy repositories.
  • SafetyCredentials & tokensFindings may include real active credentials; treat reports, CI logs, and exported SARIF or JSON artifacts as sensitive.
  • SafetyGeneralThe upstream README states Gitleaks is feature complete and future releases are expected to be security patches only.
  • PrivacyCredentials & tokensScans inspect repository contents, file contents, commit metadata, and streamed input for credential-like strings.
  • PrivacyCredentials & tokensReport files and verbose logs can contain secret values unless redaction and artifact retention are configured carefully.
  • PrivacyThird-party handlingCI integrations may expose findings to workflow logs, code-scanning systems, or third-party build infrastructure.

Disclosure: editorial

Safety notes

  • Gitleaks can scan git history and large directories, so scope scans intentionally and use baselines for noisy legacy repositories.
  • Findings may include real active credentials; treat reports, CI logs, and exported SARIF or JSON artifacts as sensitive.
  • The upstream README states Gitleaks is feature complete and future releases are expected to be security patches only.

Privacy notes

  • Scans inspect repository contents, file contents, commit metadata, and streamed input for credential-like strings.
  • Report files and verbose logs can contain secret values unless redaction and artifact retention are configured carefully.
  • CI integrations may expose findings to workflow logs, code-scanning systems, or third-party build infrastructure.

Prerequisites

  • A repository, directory, file, or stdin stream that you are authorized to scan.
  • Gitleaks installed through Homebrew, Docker, Go, a release binary, pre-commit, or the official GitHub Action.
  • A plan for handling findings, baselines, and allowed test credentials without exposing real secrets in reports.

Schema details

Install type
copy
Troubleshooting
No
Source repository stats
Scope
Source repo
Tool listing metadata
Pricing
open-source
Disclosure
editorial
Application category
SecurityApplication
Operating system
macOS, Windows, Linux, Docker
Full copyable content
## Editorial notes

Gitleaks is a useful fit for AI-generated code review because agents can accidentally introduce placeholders, copied credentials, or leaked tokens into diffs. Running a focused Gitleaks scan before merge gives maintainers a concrete check for secret exposure across working trees, files, stdin, and git history.

## Source notes

- The official README describes Gitleaks as a tool for detecting passwords, API keys, and tokens in git repositories, files, directories, and stdin.
- The README documents installation through Homebrew, Docker, Go/source builds, release binaries, pre-commit, and the Gitleaks GitHub Action.
- The documented scan modes include `git`, `dir`, and `stdin`, with redaction, report, baseline, and configuration options.

## Duplicate check

Checked current `content/tools/`, open pull requests, and repository-wide content for `Gitleaks`, `gitleaks.io`, `github.com/gitleaks/gitleaks`, `secret scanner`, `secret scanning`, and `secrets`. Existing files only mention secret scanning generically or reference Gitleaks inside broader security guidance; no dedicated Gitleaks tools entry or open duplicate PR was found.

## Disclosure

Editorial listing. No paid placement or affiliate link is used.

About this resource

Editorial notes

Gitleaks is a useful fit for AI-generated code review because agents can accidentally introduce placeholders, copied credentials, or leaked tokens into diffs. Running a focused Gitleaks scan before merge gives maintainers a concrete check for secret exposure across working trees, files, stdin, and git history.

Source notes

  • The official README describes Gitleaks as a tool for detecting passwords, API keys, and tokens in git repositories, files, directories, and stdin.
  • The README documents installation through Homebrew, Docker, Go/source builds, release binaries, pre-commit, and the Gitleaks GitHub Action.
  • The documented scan modes include git, dir, and stdin, with redaction, report, baseline, and configuration options.

Duplicate check

Checked current content/tools/, open pull requests, and repository-wide content for Gitleaks, gitleaks.io, github.com/gitleaks/gitleaks, secret scanner, secret scanning, and secrets. Existing files only mention secret scanning generically or reference Gitleaks inside broader security guidance; no dedicated Gitleaks tools entry or open duplicate PR was found.

Disclosure

Editorial listing. No paid placement or affiliate link is used.

#security#secrets#code-review

Source citations

Add this badge to your README

Show that Gitleaks is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/tools/gitleaks.svg)](https://heyclau.de/entry/tools/gitleaks)

How it compares

Gitleaks side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

1 trust signal differ across this comparison (Submitter).

Next steps differ across entries — use the actions in the table below to copy install commands and source links per resource.

Field
Gitleaks logoGitleaks

Open-source secret scanner for finding passwords, API keys, tokens, and other credentials in git history, files, directories, and stdin.

Open dossier
Pre-Write Secret Scanner - Claude Code Hook

PreToolUse hook that scans the exact text Claude Code is about to write or edit for high-confidence secret formats (AWS access keys, GitHub tokens, OpenAI keys, Slack tokens, Google API keys, Stripe keys, and private key blocks) and blocks the write with a non-zero exit before the secret ever reaches disk.

Open dossier
Privacy-First Research Workflow

A source-backed collection for private research workflows: local-first planning, reproducible notebooks, local analytical processing, redaction, human review datasets, trace review, and secret scanning before outputs are shared.

Open dossier
Sensitive Data Alert Scanner - Hooks

Scans for potential sensitive data exposure and alerts immediately.

Open dossier
Next stepsDiffers
Open dossierAPI JSONOpen LLMOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMOpen sourceNewsletterClaim listing
Trust
Review statusReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
SubmitterDiffersoktofeesh1jony376MkDev11—
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
BrandGitleaks logoGitleaks———
Categorytoolshookscollectionshooks
SourceSource-backedSource-backedSource-backedSource-backed
AuthorGitleaksjony376MkDev11JSONbored
Added2026-06-032026-06-042026-06-042025-09-19
Platforms
CLI
Claude Code
Claude Code
Claude Code
Harness
CLI
Claude Code
Claude Code
Claude Code
Source repo————
Safety notes✓Gitleaks can scan git history and large directories, so scope scans intentionally and use baselines for noisy legacy repositories. Findings may include real active credentials; treat reports, CI logs, and exported SARIF or JSON artifacts as sensitive. The upstream README states Gitleaks is feature complete and future releases are expected to be security patches only.✓Runs before every Write, Edit, and MultiEdit and reads the pending content from the tool input on stdin. Blocks the write with exit code 2 when a high-confidence secret pattern matches; no files are created, deleted, or modified by the hook itself. Uses regex heuristics, so it can produce false positives (block a non-secret) or false negatives (miss an obfuscated secret); treat it as a guardrail, not proof of safety. Makes no network calls and runs entirely locally. Safe for user-level settings only when the command points to a trusted script you installed under your home directory; do not configure global hooks to execute scripts from `$CLAUDE_PROJECT_DIR`.✓This collection is workflow guidance; each linked notebook, database, labeling, tracing, or scanning tool can still execute code or process sensitive data. Keep private research data out of hosted model prompts, public notebooks, shared traces, and exported datasets unless the data owner has approved that route. Run secret and sensitive-data checks before committing notes, prompts, labels, notebook outputs, or generated reports.✓Runs on notification events and scans recent tool input for patterns that resemble secrets or sensitive data. Produces alerts only and does not redact files, rotate credentials, or block the original tool action. Pattern-based detection can miss real secrets or flag harmless placeholders.
Privacy notes✓Scans inspect repository contents, file contents, commit metadata, and streamed input for credential-like strings. Report files and verbose logs can contain secret values unless redaction and artifact retention are configured carefully. CI integrations may expose findings to workflow logs, code-scanning systems, or third-party build infrastructure.✓Reads the text about to be written but never prints the matched secret value; only the detected secret type and the target file path are written to stderr. Writes nothing to disk and retains no logs. The target file path shown in the message may reveal local directory structure in your terminal output.✓Research workspaces can contain source documents, interview notes, citations, prompt drafts, labels, embeddings, traces, screenshots, and derived conclusions. Notebook outputs, DuckDB files, Polars exports, Label Studio projects, TruLens traces, and scanner reports may retain private content after the original source is deleted. Local-first tools reduce unnecessary sharing, but backups, sync folders, telemetry, browser downloads, and collaboration platforms still need retention and access-control review.✓Reads hook input fields such as tool names, file paths, commands, and text snippets supplied to the notification event. May print matched sensitive-looking strings or surrounding context to local hook output. Does not send findings to a remote service in the bundled script.
Prerequisites
  • A repository, directory, file, or stdin stream that you are authorized to scan.
  • Gitleaks installed through Homebrew, Docker, Go, a release binary, pre-commit, or the official GitHub Action.
  • A plan for handling findings, baselines, and allowed test credentials without exposing real secrets in reports.
  • Claude Code CLI with hooks enabled.
  • bash and jq available on PATH (the hook fails open and does not block if jq is missing).
  • A written research data boundary that separates public sources, licensed material, private notes, customer data, and restricted datasets.
  • A local or approved private workspace for notebooks, data files, labels, traces, prompts, and exports.
  • Redaction rules for prompts, extracted passages, tabular data, labels, traces, screenshots, and final reports.
  • Agreement on which outputs can leave the local workspace and which require review before sharing.
— none listed
Install—
mkdir -p "$HOME/.claude/hooks" && touch "$HOME/.claude/hooks/pre-write-secret-scanner.sh" && chmod +x "$HOME/.claude/hooks/pre-write-secret-scanner.sh"
—
mkdir -p .claude/hooks && touch .claude/hooks/sensitive-data-alert-scanner.sh && chmod +x .claude/hooks/sensitive-data-alert-scanner.sh
Config—
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "$HOME/.claude/hooks/pre-write-secret-scanner.sh"
          }
        ]
      }
    ]
  }
}
—
{
  "hooks": {
    "notification": {
      "script": "./.claude/hooks/sensitive-data-alert-scanner.sh",
      "matchers": [
        "*"
      ]
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Source-backed guides for putting this to work.

Review AI-Generated Code Before Merge

Review AI-generated pull requests with repeatable security, test, and evidence checks.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by MkDev11

Secret Handling For MCP Servers And Agent Tools

Handle MCP and agent-tool secrets safely with env expansion, OAuth scopes, keychain storage, and redaction checklists.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by kiannidev

Auditing MCP Client Configuration Before Team Rollout

Audit MCP client configuration before sharing it with a team.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by YB0y

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.