29.4k stars · MIT · v8.30.1, read from /releases/latest, shown as '21 Mar' with no year; ungh.cc dates the same tag 2026-03-21 with the year present · Track this in Scout
It searches a Git repository, including its whole history, for passwords and keys that were committed by mistake.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A single command-line program written in Go, with about two hundred built-in rules for recognising the shape of a secret: cloud keys, database passwords, payment keys, personal access tokens. It can scan the files as they are now, the whole commit history, or run automatically before every commit.
What it is good for. Anyone who writes code without a colleague to review it, and anyone about to make a private repository public. It is also worth running on a repository that has already been public for years, because the useful question is not whether a secret is visible today but whether one was ever committed. A key that was live for one afternoon in 2023 is still a live key if nobody rotated it.
- It is one downloaded file and needs nothing else installed.
- It reads history, which is the part people forget. Searching current files finds almost nothing useful.
- Running it before each commit means the mistake never gets recorded in the first place.
- It reports things that are not secrets. A random-looking test string matches the same patterns. Expect to read the list and dismiss some of it.
- It cannot fix anything. Finding an old key tells you to go and cancel that key at the provider, which is manual work.
- Rewriting history to remove a secret is a separate, harder job with a real chance of breaking other people's copies of the repository.
trufflesecurity/trufflehogIt also hunts for leaked credentials, but it goes a step further and tries each one against the live service to see whether it still works, across many more sources than Git.
Track this in Scout
Yelp/detect-secretsIt also finds secrets in a code base, but it is built around a signed-off baseline file so a team only ever reviews what is new.
Track this in Scout
getsops/sopsIt works on the other side of the same problem: instead of finding a secret that was committed, it encrypts the values in a settings file so committing it is safe.
Track this in Scout
# macOS or Linux with Homebrew brew install gitleaks # or download the binary for your system from # https://github.com/gitleaks/gitleaks/releases # scan the files as they are now gitleaks dir . -v # scan the whole commit history gitleaks git . -v
