Gitleaks

Gitleaks is a command-line tool that scans git repositories, files, directories, and stdin for hardcoded secrets like API keys, passwords, and tokens. It is written in Go and ships as a single static binary.

The detection engine is regex-driven: each rule is a regular expression (optionally combined with a Shannon-entropy threshold and keyword pre-filter) that runs against every fragment of source code Gitleaks ingests. A blog post by the author summarizes the philosophy: "Regex is (almost) all you need".

What this wiki covers

Section	What you'll find
Overview	Project summary, architecture, getting started, glossary
By the numbers	Codebase size, language breakdown, churn
Lore	Eras of the project from 2018 to today
Fun facts	Oldest code, longest files, naming origins
How to contribute	Workflow, testing, debugging, conventions
Systems	Internal building blocks: detect, config, sources, codec, report, cmd
Features	Cross-cutting capabilities: rules, allowlists, composite rules, decoding, archives, baselines
Reference	Configuration format, dependencies

Three scan modes

Gitleaks exposes three scanning entry points, all of which feed into the same detection engine (detect/detect.go):

• gitleaks git [repo] — scans git history via git log -p (or git diff for --pre-commit / --staged)
• gitleaks dir [path] — walks a directory tree on disk
• gitleaks stdin — reads from standard input for use in pipelines

The legacy detect and protect commands are still wired up but hidden from --help; they delegate to the same code paths. See cmd/detect.go for the command-translation table.

Where to start reading code

If you've never read the codebase before, the recommended path is:

1. main.go — sets up signal handling and calls cmd.Execute()
2. cmd/root.go — Cobra root command, persistent flags, and shared Detector constructor
3. detect/detect.go — Detector.DetectContext is the heart of the scanner
4. config/config.go and config/gitleaks.toml — rules, allowlists, and the embedded default config

From there, follow the systems and features pages for whichever subsystem is relevant to your change.