Gitleaks

gitleaks/gitleaks last check 183 releases 6m+
Notes

Find secrets with Gitleaks 🔑

Release notes
view on github
8.0.0 · 1y+

Gitleaks v8.0.0 introduces some breaking changes and feature removals. My vision for gitleaks is for the project to follow the unix philosophy -- do one thing and one thing well. That one thing is detecting secrets efficiently.

Sorry if this causes any inconveniences. You can always fork older versions of Gitleaks.

What's changed

  • Swapped go-git for shelling out git log -p and git diff commands when scanning/protecting git repos
    • See comparison metrics/chart 🌎 🍃
    • Memory Usage from running gitleaks on the gitleaks repo: 54MB -> 8.5MB
    • Simplified call stack
    • Faster scans
  • ghrc support
  • Added detect, protect, help, and version commands to reduce number of options
  • Support for multiline regular expressions in rules
  • Added StartLine, EndLine, StartColumn, EndColumn to report findings
  • Added RuleID to report findings
  • CLI powered by spf13/cobra
  • Removed repo-config support
    • This can be scripted
  • Default config path added (--source/-s)/.gitleaks.toml, see usage for more details
  • Removed cloning support
    • I do not want gitleaks to be responsible for cloning repositories
  • Removed files at commit support
    • This can be accomplished by git checkout
  • Removed all commit options
    • All commit options can be supported by the --log-opts argument. --log-opts accepts any git log options.
  • All log messages sent to stderr
  • Finding output (enabled with -v/--verbose) sent to stdout.
    • This can be paired with jq to do additional filtering
  • Added 60+ rules to best maintain parity with https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-for-private-repositories
  • Updated Config

If you find any bugs or issues related to this release please open an issue or PR with the tag v8.

If Gitleaks has brought you commercial success please consider supporting me via Github sponsors, like Typeform. Typeform recently donated $1000 and wrote a very nice blog post about preventing secret leaks at scale.