Skip to content
SPECIFICTION
Get listed

Gitleaks

github.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 7.8 #11 of 24 in Secrets Scanning Software

What it is

Gitleaks is free, MIT-licensed software that detects secrets such as passwords, API keys, and tokens in Git repositories, files, and standard input. It runs on Linux, macOS, Windows, and self-hosted systems. Scans can target repositories, directories, individual files, or streamed data. Custom rules can use Go regular expressions, entropy checks, path matching, keywords, and allowlists. A previous report can serve as a baseline so later scans show only new findings. Output is available in JSON, CSV, JUnit, SARIF, or template formats. The project documents pre-commit hook and GitHub Action use, plus CI/CD, pull-request, and supported VCS workflows for GitHub, GitLab, Azure DevOps, Gitea, and Bitbucket. Installation options include Homebrew, Docker, Go, and prebuilt release binaries. A redaction option masks secrets in logs and standard output, with a default redaction value of 100%. The project describes itself as feature complete, with future releases limited to security patches, and its security policy supports only the latest version.

Spec sheet

Purpose
Gitleaks detects secrets such as passwords, API keys, and tokens in Git repositories, files, and stdin.Read 2 Oct 2026 · github.com
Platforms
The releases page lists binaries for macOS, Linux, and Windows architectures.Read 2 Oct 2026 · github.com
Integrations
The project documents use as a pre-commit hook and as a GitHub Action.Read 2 Oct 2026 · github.com
License
The repository is distributed under the MIT License, which permits use, copying, modification, distribution, sublicensing, and sale subject to its terms.Read 2 Oct 2026 · github.com
Baselines
A report can be used as a baseline so subsequent scans report only new findings.Read 2 Oct 2026 · github.com
Detection rules
Users can configure custom detection rules using Go regular expressions, entropy checks, path matching, keywords, and allowlists.Read 2 Oct 2026 · github.com
Installation
The project documents installation through Homebrew, Docker, Go, and prebuilt release binaries.Read 2 Oct 2026 · github.com
Maintenance status
The project says it is feature complete and future releases will be security patches only.Read 2 Oct 2026 · github.com
Reports
Gitleaks can output reports in JSON, CSV, JUnit, SARIF, or template format.Read 2 Oct 2026 · github.com
Scan modes
Gitleaks supports scanning Git repositories, directories or files, and data streamed through stdin.Read 2 Oct 2026 · github.com
Secret handling
The CLI has a redaction option that can redact secrets in logs and standard output, with a default redaction value of 100%.Read 2 Oct 2026 · github.com
Security reporting
The security policy asks users to report vulnerabilities privately through GitHub rather than opening a public issue.Read 2 Oct 2026 · github.com
Support scope
The security policy says only the latest version is supported.Read 2 Oct 2026 · github.com

Plans and prices

Gitleaks Free MIT-licensed software · latest version supported Read 2 Oct 2026 · github.com

Every Gitleaks plan and price →

Strong points and limits

Strong points

  • Scans repositories, files, directories, and standard input
  • Custom rules support regex, entropy, paths, and allowlists
  • Reports include JSON, CSV, JUnit, and SARIF
  • Supports pre-commit hooks and GitHub Actions
  • Runs on Linux, macOS, Windows, and self-hosted systems

Limits

  • Only the latest version is supported
  • Future releases are limited to security patches
  • Secret scanning requires configuring suitable detection rules

Who it suits

It suits developers and security teams scanning repositories, files, or pipelines for exposed secrets. Teams using supported Git platforms, CI/CD, pre-commit hooks, or pull requests can integrate its documented workflows.

Verdict

Gitleaks provides a free command-line approach to secret detection across repositories, files, and development workflows. Its feature-complete status means ongoing releases are restricted to security patches, with support limited to the latest version.

Where Specifiction places it

Alternatives to GitleaksAll alternatives →