Freedom251 › Secrets Scanning Software
Gitleaks
What Gitleaks is
Gitleaks is free, MIT-licensed software that detects secrets such as passwords, API keys, and tokens in Git repositories, files, and data streamed through stdin. It can scan repositories, directories, individual files, or standard input, and runs on Linux, macOS, and Windows; self-hosting is also listed. Users can configure detection with Go regular expressions, entropy checks, path matching, keywords, and allowlists. A report can serve as a baseline so later scans show only new findings. Output options include JSON, CSV, JUnit, SARIF, and template formats. The project documents use as a pre-commit hook and GitHub Action, with support for CI/CD, pull-request, and pre-commit scanning. Installation options include Homebrew, Docker, Go, and prebuilt release binaries. A redaction setting can mask secrets in logs and standard output, with a default value of 100%. The project calls Gitleaks feature complete, with future releases limited to security patches, and says only the latest version is supported. Vulnerabilities should be reported privately through GitHub.
Who it suits
Gitleaks suits developers and teams that need to scan repositories, files, or streamed data for exposed secrets. Its custom rules, baselines, and CI/CD integrations may suit teams building secret checks into development workflows.
What it does well
- Scans repositories, files, directories, and stdin.
- Supports configurable detection rules and allowlists.
- Reports can be output in five formats.
- Supports pre-commit, pull-request, and CI/CD scanning.
- Free under the MIT License.
What to know first
- Future releases are limited to security patches.
- Only the latest version is supported.
Limits
The listed free plan supports only the latest version. The project describes Gitleaks as feature complete, with future releases limited to security patches.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Gitleaks | MIT-licensed software · latest version supported | Free |
As github.com lists them, read 2 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Gitleaks repository.
- Choose an installation route: Homebrew, Docker, Go, or a prebuilt release binary.
- Run it against a Git repository, directory, file, or data streamed through stdin.
- Configure custom detection rules or a baseline report if needed.
- Add it as a pre-commit hook or GitHub Action if that fits your workflow.
Verdict
Gitleaks offers configurable secret scanning across common repository and development workflows, with multiple report formats and installation options. Its maintenance scope is limited: the project describes it as feature complete and supports only the latest version.
Questions
How much does Gitleaks cost?
The listed plan is free. The software is distributed under the MIT License.
What can Gitleaks scan?
It scans Git repositories, directories or files, and data streamed through stdin.
Which platforms and Git services are supported?
It runs on Linux, macOS, and Windows, and can be self-hosted. Supported VCS platforms are GitHub, GitLab, Azure DevOps, Gitea, and Bitbucket.
Can I use custom detection rules?
Yes. Rules can use Go regular expressions, entropy checks, path matching, keywords, and allowlists.
What report formats are available?
Gitleaks can produce JSON, CSV, JUnit, SARIF, or template-format reports. A report can also serve as a baseline for later scans.
Is Gitleaks still adding features?
The project says it is feature complete, with future releases limited to security patches. Its security policy supports only the latest version.
Facts from Gitleaks's own pages
- Baselines
- A report can be used as a baseline so subsequent scans report only new findings. · github.com, 2 Oct 2026
- Detection rules
- Users can configure custom detection rules using Go regular expressions, entropy checks, path matching, keywords, and allowlists. · github.com, 2 Oct 2026
- Installation
- The project documents installation through Homebrew, Docker, Go, and prebuilt release binaries. · github.com, 2 Oct 2026
- Integrations
- The project documents use as a pre-commit hook and as a GitHub Action. · github.com, 2 Oct 2026
- License
- The repository is distributed under the MIT License, which permits use, copying, modification, distribution, sublicensing, and sale subject to its terms. · github.com, 2 Oct 2026
- Maintenance status
- The project says it is feature complete and future releases will be security patches only. · github.com, 2 Oct 2026
- Platforms
- The releases page lists binaries for macOS, Linux, and Windows architectures. · github.com, 2 Oct 2026
- Purpose
- Gitleaks detects secrets such as passwords, API keys, and tokens in Git repositories, files, and stdin. · github.com, 2 Oct 2026
- Reports
- Gitleaks can output reports in JSON, CSV, JUnit, SARIF, or template format. · github.com, 2 Oct 2026
- Scan modes
- Gitleaks supports scanning Git repositories, directories or files, and data streamed through stdin. · github.com, 2 Oct 2026
- Secret handling
- The CLI has a redaction option that can redact secrets in logs and standard output, with a default redaction value of 100%. · github.com, 2 Oct 2026
- Security reporting
- The security policy asks users to report vulnerabilities privately through GitHub rather than opening a public issue. · github.com, 2 Oct 2026
- Support scope
- The security policy says only the latest version is supported. · github.com, 2 Oct 2026
Where Gitleaks stands on Freedom251
- Secrets Scanning Software#9 of 24