Gitleaks

Welcome to gitleaks v1.0.0

Gitleaks v1.0.0 introduces major performance gains, cleaner ui, and some new features.

Installing

go get -u github.com/zricethezav/gitleaks

Or download from release binaries here

Performance

Prior to v1.0.0 Gitleaks relied on shelling out git commands. This meant for every diff you would be reading from disk. Thanks to src-d's go-git package you are now able to process your repos in memory with the --in-memory option. Additionally, Gitleaks v1.0.0 audits just additions and deletions in your commit patches -- before, gitleaks looked at the entire commit patch. Another gain v1.0.0 introduces is support for whitelisting commits, files, regexes, and branches specified in GITLEAKS_CONFIG or --config= options config.

UI

Gitleaks v1.0.0 uses jessevdk's go-flags which offers much cleaner option handling. Let's go through some examples:

# audit a single public repo
$ gitleaks --repo=https://github.com/gitleakstest/gronit

# audit a single private repo
# NOTE: SSH auth only -- this requires your private key (default: ~/.ssh/id_rsa) or set by --ssh-key
$ gitleaks --repo=git@github.com:gitleakstest/privaterepo.git

# audit github user's public repos
$ gitleaks --github-user=gitleakstest

# audit github user's private repos
# NOTE: SSH auth only -- this requires your private key (default: ~/.ssh/id_rsa) or set by --ssh-key
# NOTE: `GITHUB_TOKEN` must be set in your env otherwise it will pull public repos
$ gitleaks --github-user=gitleakstest --private

# save report to file
# NOTE: report format is json -- support for more coming in later versions
$ gitleaks --repo=https://github.com/gitleakstest/gronit --report=report.json

New Features

Externalize Regexes

A common request I heard was the ability to externalize regexes so you could search for whatever you wanted in your git history. This has been added in v1.0.0. Of course there are default checks that I have in place that include AWS, Facebook, Twitter, PGP, BGP, RSA, and Heroku but if you want to remove or add regexes all you need to do is supply gitleaks with a config specified in GITLEAKS_CONFIG or pass the path to the config as an option with --config=. The config is a simple toml file that looks like:

[[regexes]]
description = "AWS"
regex = '''AKIA[0-9A-Z]{16}'''
[[regexes]]
description = "Github"
regex = '''(?i)github.*['\"][0-9a-zA-Z]{35,40}['\"]'''
[whitelists]
files = [
  "(.*?)(jpg|gif|doc|pdf|bin)$"
]

This sample config will look for github and aws keys and ignore and jpg, gif, doc, pdf, or bin files it encounters during the audit.

Whitelists

You can whitelist more than just files! In addition to files you can whitelist regexes, branches, and commits. Say for example you want to ignore the leak that occurs for commit cb5599aeed261b2c038aa4729e2d53ca050a4988 in https://github.com/gitleakstest/gronit/commits/master. You can do this by adding including a commits array to your [whitelist] table in your config. So for the example above our config would look like this now:

[[regexes]]
description = "AWS"
regex = '''AKIA[0-9A-Z]{16}'''
[[regexes]]
description = "Github"
regex = '''(?i)github.*['\"][0-9a-zA-Z]{35,40}['\"]'''
[whitelists]
files = [
  "(.*?)(jpg|gif|doc|pdf|bin)$"
]
commits = [
  "cb5599aeed261b2c038aa4729e2d53ca050a4988"
]

Similarly you can include a branch and regex array in your whitelist table. See these tests for more examples.

Table Driven Tests

More robust code (please add to tests if you want to help the project)

Control of concurrency

You can set the maximum concurrent go routines spun up per repo with --max-go. Note: I've been running unbounded and haven't run into any problems... let me know if you do.

Audit ALL refs.

Prior to v1.0.0 Gitleaks was only auditing origin/HEAD. You can now scrub through all refs with --all-refs. NOTE: support for auditing an array of refs will be coming in next version.