By the numbers

A quantitative snapshot of the Gitleaks codebase.

Data collected on 2026-04-30 against commit 8863af4 on branch master.

Size

The repo is ~21k lines of Go across ~204 .go files.

xychart-beta horizontal
    title "Lines of Go by directory"
    x-axis ["cmd/generate/config/rules", "detect", "config", "cmd", "sources", "report", "detect/codec", "regexp", "version"]
    y-axis "Lines of code" 0 --> 14000
    bar [13000, 4400, 2900, 2400, 1900, 1100, 600, 30, 5]

(Approximate values; the rule generator is by far the largest area because it contains one Go file per supported provider.)

Bucket	Count
Total .go files	204
Production .go files	185
Test .go files	19
Distinct rule files in cmd/generate/config/rules/	131
Compiled rules in default config/gitleaks.toml	222
Total Go lines (excluding testdata/)	~21,300

The largest source files:

File	Lines
detect/detect_test.go	2773
cmd/generate/config/rules/stopwords.go	1491
detect/detect.go	900
config/config_test.go	672
cmd/root.go	548
sources/git.go	530
config/config.go	492
cmd/generate/config/rules/kubernetes.go	463

The default config/gitleaks.toml itself is ~98k lines because every rule renders multiple regex variants.

Activity

Window	Commits
All-time (since Jan 2018)	1,269
2024	279
2025	134
Last 90 days	3

The pace has been steady but spiky — releases tend to cluster (191 published tags, with v8.x going back to 2022).

Bot-attributed commits

58 of 1,269 commits (~4.6%) include a Co-authored-by: trailer. None of them target known bot accounts (*[bot]); the trailers are human co-authors. Detected bot-attributed commits: 0%.

This is a lower bound on AI assistance — inline tooling like Copilot leaves no trace in git history.

Test coverage signals

Metric	Value
Test files	19
Production files	185
Test-to-production file ratio	~10%

The ratio is low because almost all detection logic is exercised through a small number of large table-driven tests. detect/detect_test.go (2.7k lines) and config/config_test.go (672 lines) cover the bulk of behavior; per-rule fixtures live alongside the rule definitions in cmd/generate/config/rules/*.go and are validated at config-generation time, not runtime.

Complexity hotspots

The longest non-test files are good candidates if you ever consider refactoring:

File	Lines	Notes
detect/detect.go	900	Detector orchestration; mixes scanning, allowlist evaluation, composite rule logic
config/config.go	492	Viper-to-Config translation, extend/inherit logic
sources/git.go	530	git log/diff parsing, blob streaming, remote URL parsing
cmd/root.go	548	Persistent flags, Detector construction, report wiring, banner

TODO/FIXME density

There are 81 TODO/FIXME/HACK comments in the production sources. The most common motif is "TODO: Remove this in v9" — backwards-compatibility shims that have accumulated through the v8 series.

Dependencies

go.mod lists 16 direct dependencies. The notable ones:

Dependency	Purpose
github.com/spf13/cobra, github.com/spf13/viper	CLI + config
github.com/rs/zerolog	Structured logging
github.com/gitleaks/go-gitdiff	Git diff parser (project-owned fork)
github.com/BobuSumisu/aho-corasick	Multi-string matcher (keywords, stopwords)
github.com/fatih/semgroup	Bounded concurrency
github.com/wasilibs/go-re2	Optional WASM RE2 backend (build tag gore2regex)
github.com/mholt/archives	Archive identification + extraction
github.com/h2non/filetype	Binary file detection
github.com/charmbracelet/lipgloss	Terminal color output
github.com/Masterminds/sprig/v3	Template function library for --report-template

Full list in reference/dependencies.