┌─○───┐│ │╲  ││ │ ○ ││ ○ ░ │└─░───┘

Join our Discord!

➜  ~/code(master) gitleaks detect --source . -v    ○    │╲    │ ○    ○ ░    ░    gitleaksFinding:     "export BUNDLE_ENTERPRISE__CONTRIBSYS__COM=cafebabe:deadbeef",Secret:      cafebabe:deadbeefRuleID:      sidekiq-secretEntropy:     2.609850File:        cmd/generate/config/rules/sidekiq.goLine:        23Commit:      cd5226711335c68be1e720b318b7bc3135a30eb2Author:      JohnEmail:       john@users.noreply.github.comDate:        2022-08-03T12:31:40ZFingerprint: cd5226711335c68be1e720b318b7bc3135a30eb2:cmd/generate/config/rules/sidekiq.go:sidekiq-secret:23

Getting Started

Installing

# MacOSbrew install gitleaks# Docker (DockerHub)docker pull zricethezav/gitleaks:latestdocker run -v${path_to_host_folder_to_scan}:/path zricethezav/gitleaks:latest [COMMAND] --source="/path" [OPTIONS]# Docker (ghcr.io)docker pull ghcr.io/gitleaks/gitleaks:latestdocker run -v${path_to_host_folder_to_scan}:/path ghcr.io/gitleaks/gitleaks:latest [COMMAND] --source="/path" [OPTIONS]# From Source (make sure `go` is installed)git clone https://github.com/gitleaks/gitleaks.gitcd gitleaksmake build

GitHub Action

name: gitleakson: [pull_request, push, workflow_dispatch]jobs:  scan:    name: gitleaks    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v3        with:          fetch-depth: 0      - uses: gitleaks/gitleaks-action@v2        env:          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for Organizations, not personal accounts.

Pre-Commit

➜ git commit -m "this commit contains a secret"Detect hardcoded secrets.................................................Failed

➜ SKIP=gitleaks git commit -m "skip gitleaks check"Detect hardcoded secrets................................................Skipped

Usage

Usage:  gitleaks [command]Available Commands:  completion  generate the autocompletion script for the specified shell  detect      detect secrets in code  help        Help about any command  protect     protect secrets in code  version     display gitleaks versionFlags:  -b, --baseline-path string       path to baseline with issues that can be ignored  -c, --config string              config file path                                   order of precedence:                                   1. --config/-c                                   2. env var GITLEAKS_CONFIG                                   3. (--source/-s)/.gitleaks.toml                                   If none of the three options are used, then gitleaks will use the default config      --exit-code int              exit code when leaks have been encountered (default 1)  -h, --help                       help for gitleaks  -l, --log-level string           log level (trace, debug, info, warn, error, fatal) (default "info")      --max-target-megabytes int   files larger than this will be skipped      --no-color                   turn off color for verbose output      --no-banner                  suppress banner      --redact                     redact secrets from logs and stdout  -f, --report-format string       output format (json, csv, junit, sarif) (default "json")  -r, --report-path string         report file  -s, --source string              path to source (default ".")  -v, --verbose                    show verbose output from scanUse "gitleaks [command] --help" for more information about a command.

Commands

Detect

Protect

Creating a baseline

gitleaks detect --report-path gitleaks-report.json # This will save the report in a file called gitleaks-report.json

gitleaks detect --baseline-path gitleaks-report.json --report-path findings.json

Verify Findings

Finding:     aws_secret="AKIAIMNOJVGFDXXXE4OA"RuleID:      aws-access-tokenSecret       AKIAIMNOJVGFDXXXE4OAEntropy:     3.65File:        checks_test.goLine:        37Commit:      ec2fc9d6cb0954fb3b57201cf6133c48d8ca0d29Author:      Zachary RiceEmail:       z@email.comDate:        2018-01-28T17:39:00ZFingerprint: ec2fc9d6cb0954fb3b57201cf6133c48d8ca0d29:checks_test.go:aws-access-token:37

git log -L {StartLine,EndLine}:{File} {Commit}

git log -L 37,37:checks_test.go ec2fc9d6cb0954fb3b57201cf6133c48d8ca0d29

commit ec2fc9d6cb0954fb3b57201cf6133c48d8ca0d29Author: zricethezav <thisispublicanyways@gmail.com>Date:   Sun Jan 28 17:39:00 2018 -0500    [update] entropy checkdiff --git a/checks_test.go b/checks_test.go--- a/checks_test.go+++ b/checks_test.go@@ -28,0 +37,1 @@+               "aws_secret= \"AKIAIMNOJVGFDXXXE4OA\"":          true,

Pre-Commit hook

Configuration

# Title for the gitleaks configuration file.title ="Gitleaks title"# Extend the base (this) configuration. When you extend a configuration# the base rules take precedence over the extended rules. I.e., if there are# duplicate rules in both the base configuration and the extended configuration# the base rules will override the extended rules.# Another thing to know with extending configurations is you can chain together# multiple configuration files to a depth of 2. Allowlist arrays are appended# and can contain duplicates.# useDefault and path can NOT be used at the same time. Choose one.[extend]# useDefault will extend the base configuration with the default gitleaks config:# https://github.com/zricethezav/gitleaks/blob/master/config/gitleaks.tomluseDefault =true# or you can supply a path to a configuration. Path is relative to where gitleaks# was invoked, not the location of the base config.path ="common_config.toml"# An array of tables that contain information that define instructions# on how to detect secrets[[rules]]# Unique identifier for this ruleid ="awesome-rule-1"# Short human readable description of the rule.description ="awesome rule 1"# Golang regular expression used to detect secrets. Note Golang's regex engine# does not support lookaheads.regex ='''one-go-style-regex-for-this-rule'''# Golang regular expression used to match paths. This can be used as a standalone rule or it can be used# in conjunction with a valid `regex` entry.path ='''a-file-path-regex'''# Array of strings used for metadata and reporting purposes.tags = ["tag","another tag"]# Int used to extract secret from regex match and used as the group that will have# its entropy checked if `entropy` is set.secretGroup =3# Float representing the minimum shannon entropy a regex group must have to be considered a secret.entropy =3.5# Keywords are used for pre-regex check filtering. Rules that contain# keywords will perform a quick string compare check to make sure the# keyword(s) are in the content being scanned. Ideally these values should# either be part of the idenitifer or unique strings specific to the rule's regex# (introduced in v8.6.0)keywords = ["auth","password","token",]# You can include an allowlist table for a single rule to reduce false positives or ignore commits# with known/rotated secrets[rules.allowlist]description ="ignore commit A"commits = ["commit-A","commit-B"]paths = ['''go\.mod''','''go\.sum''']# note: (rule) regexTarget defaults to check the _Secret_ in the finding.# if regexTarget is not specified then _Secret_ will be used.# Acceptable values for regexTarget are "match" and "line"regexTarget ="match"regexes = ['''process''','''getenv''',]# note: stopwords targets the extracted secret, not the entire regex match# like 'regexes' does. (stopwords introduced in 8.8.0)stopwords = ['''client''','''endpoint''',]# This is a global allowlist which has a higher order of precedence than rule-specific allowlists.# If a commit listed in the `commits` field below is encountered then that commit will be skipped and no# secrets will be detected for said commit. The same logic applies for regexes and paths.[allowlist]description ="global allow list"commits = ["commit-A","commit-B","commit-C"]paths = ['''gitleaks\.toml''','''(.*?)(jpg|gif|doc)''']# note: (global) regexTarget defaults to check the _Secret_ in the finding.# if regexTarget is not specified then _Secret_ will be used.# Acceptable values for regexTarget are "match" and "line"regexTarget ="match"regexes = ['''219-09-9999''','''078-05-1120''','''(9[0-9]{2}|666)-\d{2}-\d{4}''',]# note: stopwords targets the extracted secret, not the entire regex match# like 'regexes' does. (stopwords introduced in 8.8.0)stopwords = ['''client''','''endpoint''',]

Additional Configuration

gitleaks:allow

class CustomClass:    discord_client_secret = '8dyfuiRyq=vVc3RRr_edRk-fK__JItpZ'  #gitleaks:allow

.gitleaksignore

Sponsorships

coderabbit.ai

Exit Codes

0 - no leaks present1 - leaks or error encountered126 - unknown flag