Gitleaks

Version 2.0.0 of gitleaks introducing a major change to the gitleaks.toml configuration file. This change allows users to define more aggressive filters by combining three techniques: regex, entropy, and file matching. Goodbye [[regexes]], hello [[rules]]. Below is an example rule that combines these three filtering techniques:

[[rules]]
description = "Generic Key"
regex = '''(?i)key(.{0,6})?(:|=|=>|:=)'''
entropies = [
    "4.1-4.3",
    "5.5-6.3",
]
entropyROI = "line"
filetypes = [".go", ".py", ".c"]
tags = ["key"]
severity = "8"

This rule will first attempt to match the regex, then see if the entropy value of either the line or word --depending on entropyROI-- is within the range of entropies, then it will check if the filetype. If all three conditions are met, then voilà, you have a leak.

tags and severity are used for post-audit reporting as per https://github.com/zricethezav/gitleaks/issues/193

Supplemental video https://www.youtube.com/watch?v=e6tqps8MnTY