This article follows the official documentation. We haven’t tested this tool for a hands-on review.
When a coding agent can read and edit a Git repository, it can also copy a password, API key, or token into a source file. Gitleaks scans files and Git repositories for strings that match secret-detection rules. After making changes, a coding agent can run Gitleaks locally and report each finding's file and line without repeating the matched value.
Gitleaks matches text against rules. Its documented commands do not test whether a flagged credential still works. A clean scan also does not prove that every secret format was detected. Use it as a check before sharing changes, and review findings before deciding how to handle them.
Install and scan the working files
On macOS with Homebrew installed, install Gitleaks with:
brew install gitleaks
The README also documents Docker images and a source build with Go. Prebuilt binaries for other systems are on the releases page. The path below is a placeholder: replace /path/to/repo with the local repository directory.
cd /path/to/repo
gitleaks dir -v --redact=100 .
The dir command scans files in the current directory. The -v flag prints each finding with its file and line. Without it, Gitleaks only logs how many leaks it found. The --redact=100 flag masks the full secret value in the printed findings. Gitleaks reads the files and does not change them.
Run gitleaks git -v --redact=100 from the repository to scan its Git history. Because Git history includes earlier committed versions, deleting a credential from the latest file leaves it in older commits. Use dir to check the current files and git to check the repository history.
Gitleaks exits with code 0 when it finds no leaks and 1 when it finds leaks or hits an error, as listed in the exit code section. An agent can use that exit code to tell a clean scan from one that needs review. The --exit-code flag changes the code used for findings.
Gitleaks also accepts input through standard input with the stdin command. It writes reports in JSON and CSV, as well as JUnit and SARIF formats, with the --report-format and --report-path flags:
gitleaks git --redact=100 --report-format json --report-path gitleaks-report.json
Gitleaks saves the report to a local file and leaves the scanned source unchanged. With --redact, the findings in the report are masked too. Treat reports as sensitive anyway, because they still list file paths and commit details such as author names and email addresses.
Use the scan in an agent task
Use Gitleaks to check an agent's edits before it returns a patch. Ask the agent to scan the working files, inspect each finding without repeating the matched value, and summarize its file, line, and likely next step for a person to review.
For example, give the agent this prompt:
Before you finish, run `gitleaks dir -v --redact=100 .` from the repository root.
If it reports findings, summarize their file and line locations without copying
secret values into your response. Do not delete or rotate credentials. Tell me
which findings need my review.
This is a local check. Gitleaks does not send the found values anywhere for validation. Redaction hides a value in the output, but it does not tell you whether the credential is still live. If a real credential appears in a finding, the credential owner should decide whether to revoke or rotate it. If the credential entered Git history, deleting it from the current file leaves it in earlier commits.
Know what the rules can miss
Gitleaks relies on patterns, including its default rules and any project-specific rules. Gitleaks can flag harmless test values that match a rule, and it can miss secrets whose format matches no rule. For example, the cloudflare-api-key rule in the default configuration only matches a key when the word "cloudflare" appears right before it, as in a variable name. A project that stores such keys under another name should check whether its configuration needs an additional rule. Gitleaks loads a .gitleaks.toml file from the scan target automatically, and the --config flag points it to another file.
The maintainer has marked Gitleaks as feature complete. The README says future releases will be security patches only.
Local scanning requires no account login or Gitleaks credential. The official GitHub Action is different. Gitleaks-Action needs a free license key in the GITLEAKS_LICENSE secret when it scans repositories that belong to an organization account. Repositories of personal accounts need no key. Store the key as an encrypted GitHub secret and keep it out of agent prompts.