Systems

Internal building blocks of the Gitleaks binary. Each page below covers one Go package (or directory) in depth.

System	Source	Responsibility
cmd	cmd/	Cobra CLI: git, dir, stdin, plus deprecated detect/protect
detect	detect/	The detection engine: Detector, rule loop, allowlist evaluation, baseline filtering
config	config/	Rule + allowlist parsing, the embedded default gitleaks.toml, extend/inherit
sources	sources/	Producers of Fragments: git history, filesystem, single readers, archives
codec	detect/codec/	Recursive base64/hex/percent decoding
report	report/	Output formats: JSON, CSV, JUnit, SARIF, template
regexp	regexp/	Build-tag pluggable regex engine

Adjacent code that doesn't warrant a full page:

• logging/ — a thin wrapper around zerolog. Single file (logging/log.go — see the package). Use logging.Debug(), .Trace(), .Warn(), etc. Don't import zerolog directly.
• version/ — a single variable populated by -ldflags at build time. See version/version.go.
• cmd/scm/ — the scm.Platform enum (GitHub, GitLab, Azure DevOps, Gitea, Bitbucket) plus parsing. Used to render finding Link URLs. See cmd/scm/scm.go.
• cmd/generate/ — offline tool that regenerates config/gitleaks.toml from per-provider rule files. Documented in how to contribute.

If you're new to the codebase, read detect first — it's the heart of the scanner — and then branch out to whichever system is relevant to your change.