Fun facts

A grab bag of trivia about the codebase.

The longest source file is 95% test fixtures

detect/detect_test.go is 2,773 lines long, but most of it is table-driven test cases enumerating expected findings for every rule shape Gitleaks supports. The actual assertion logic is small; the volume comes from input/expected pairs.

The default config file is bigger than most repos

config/gitleaks.toml is ~98,000 lines and ~1.5MB. It is generated, not hand-written — cmd/generate/config/main.go assembles it from the 131 .go files in cmd/generate/config/rules/. The reason it's so large is that each rule expands into multiple regex variants for different identifier styles (camelCase, snake_case, ALL_CAPS, quoted, unquoted, with operators like = : ==>).

The .gitleaksignore file is 944 lines long

Most entries are fingerprints for testdata files, where intentional fake secrets exist as inputs to rule unit tests. Without the ignore file, Gitleaks would fail when scanning its own repository. There is also an allowlist in .gitleaks.toml for the cmd/generate/config/rules directory for the same reason.

Two regex engines, one API

The regexp/ package is two files totaling ~25 lines, but it lets the entire project swap between Go's standard regexp package and wasilibs/go-re2 (a WebAssembly-compiled RE2) at build time via the gore2regex build tag. Every other package imports github.com/zricethezav/gitleaks/v8/regexp, never the standard library regexp directly, so the switch is transparent.

The first commit is from January 2018

The very first commit (e1a5893) is dated 2018-01-27 and is titled "[init] diffing commits for all branches, work on concurrency." The basic shape — concurrently scan diffs from git log -p — has survived every rewrite since then.

Auto-version comes from the latest git tag

Makefile computes the version with git tag | sort -V | tail -1. The Dockerfile uses git describe --tags --abbrev=0. The version is then injected via -ldflags "-X=…/version.Version=…" into the otherwise-empty version/version.go, which contains only var Version = "version is set by build process".

The ASCII banner is older than the rewrite

The branded box-drawing logo that prints when you run gitleaks (defined as the banner constant in cmd/root.go):

    ○
    │╲
    │ ○
    ○ ░
    ░    gitleaks

…predates the v8 rewrite. It survives untouched in both the README and in code.

"bruh"

The most recent commit on master at the time this wiki was generated is titled "bruh (#2067)". You'll find similar laconic git history throughout — early commits use bracketed prefixes like [init], [update], [progress], [fix]. Later commits standardized on Conventional Commits-ish prefixes (feat:, fix:, chore:).

The Go module path doesn't match the repo URL

The repo is github.com/gitleaks/gitleaks but the module path in go.mod is github.com/zricethezav/gitleaks/v8. This is the original author's personal namespace; the project moved to its own GitHub org but kept the import path stable to avoid breaking every downstream consumer.