Getting Started Guide

How to Install and Use Gitleaks

This guide covers installing Gitleaks and scanning git repositories for accidentally committed secrets, API keys, and credentials.

Prerequisites

-Git
-Go (for go install) or download binary

Official Documentation

Install Gitleaks

Install Gitleaks from Homebrew, Go, or download the binary.

macOS

brew install gitleaks

go install github.com/gitleaks/gitleaks/v8@latest

Verify

gitleaks version

Scan a Local Repository

Scan the current git repository including all commit history for secrets.

Scan current repo

gitleaks detect

Verbose output

gitleaks detect -v

Example output

Finding:     AKIA...
Secret:      AKIAIOSFODNN7EXAMPLE
RuleID:      aws-access-key-id
File:        config/deploy.sh
Commit:      abc1234...

Note: Gitleaks scans the entire git history by default, not just current files. Secrets that were committed and then deleted are still found.

Scan Staged Changes Only (Pre-Commit)

Use as a pre-commit hook to catch secrets before they're committed.

Scan staged files

gitleaks protect --staged

Git pre-commit hook

# Add to .git/hooks/pre-commit:
gitleaks protect --staged --exit-code 1

Note: The protect command only checks staged changes, making it fast enough for a pre-commit hook. This catches secrets before they enter the git history.

Scan a Remote Repository

Clone and scan a remote repository in one step.

GitHub repo

gitleaks detect --source https://github.com/owner/repo

With report

gitleaks detect --source https://github.com/owner/repo --report-format json --report-path report.json

Custom Configuration

Customize what Gitleaks looks for with a config file, or exclude known false positives.

Use custom config

gitleaks detect --config custom-gitleaks.toml

Generate baseline (ignore existing)

gitleaks detect --baseline-path .gitleaks-baseline.json

Scan with baseline

gitleaks detect --baseline-path .gitleaks-baseline.json

Note: The baseline feature is useful for legacy repos with known committed secrets that can't be rotated. Generate a baseline once, then future scans only report new findings.

Back to Gitleaks Full Documentation