← retour aux outils back to tools

# Gitleaks

Scanner de secrets rapide pour les dépôts git et les fichiers. Détecte les clés API, mots de passe, tokens et clés privées via plus de 150 règles regex avec sortie SARIF et JSON. Fast secret scanner for git repositories and files. Detects API keys, passwords, tokens, and private keys using 150+ regex rules with SARIF and JSON output.

↗ https://github.com/gitleaks/gitleaks

## Overview

Gitleaks detects hardcoded secrets in git repositories and filesystems. It scans commit history, staged files, and current working trees using 150+ built-in rules for common secret patterns. It’s faster than TruffleHog for CI/CD integration and produces SARIF output for IDE integration.

## Basic Usage

Scan a local git repository (full history)

    gitleaks detect --source /path/to/repo

Scan current directory

    gitleaks detect

Scan only staged files (pre-commit)

    gitleaks protect --staged

Scan a remote repository

    gitleaks detect --source https://github.com/target/repo

Verbose output (show all findings)

    gitleaks detect -v

## Output Formats

Default (human-readable)

    gitleaks detect --source /path/to/repo

JSON report

    gitleaks detect --source /path/to/repo -r report.json

SARIF report (for GitHub Code Scanning)

    gitleaks detect --source /path/to/repo -f sarif -r report.sarif

CSV report

    gitleaks detect --source /path/to/repo -f csv -r report.csv

## Scanning Modes

Scan all git history

    gitleaks detect --source /repo --log-opts="--all"

Scan only recent commits (last 10)

    gitleaks detect --source /repo --log-opts="-10"

Scan specific branch

    gitleaks detect --source /repo --log-opts="--branches=main,develop"

Scan between commits

    gitleaks detect --source /repo --log-opts="abc123..HEAD"

No-git mode (scan files directly, no git history)

    gitleaks detect --no-git --source /path/to/files

## Pre-commit Integration

Scan staged files before commit

    gitleaks protect --staged

→ Returns exit code 1 if secrets found

    # Install as git hook
    cat > .git/hooks/pre-commit << 'EOF'
    #!/bin/sh
    gitleaks protect --staged --redact
    EOF
    chmod +x .git/hooks/pre-commit

## CI/CD Integration

    # GitHub Actions
    - name: Gitleaks
      uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    # GitLab CI
    gitleaks:
      image: zricethezav/gitleaks:latest
      script:
        - gitleaks detect --source . -r gitleaks-report.json

    # Generic CI
    gitleaks detect --source . --exit-code 1

## Custom Rules (.gitleaks.toml)

    [extend]
    useDefault = true   # Include built-in rules

    [[rules]]
    id = "custom-api-key"
    description = "Custom API Key"
    regex = '''(?i)myapp[_-]?key[_-]?=\s*['"]?([a-zA-Z0-9]{32})'''
    secretGroup = 1
    keywords = ["myapp", "api-key"]

    [[rules.allowlists]]
    description = "Ignore test files"
    paths = ['''test/''', '''spec/''']

## Allowlisting

    # .gitleaks.toml
    [allowlist]
    description = "Global allowlist"
    regexes = ['''EXAMPLE_KEY_123''']
    paths = [
        '''(test|spec|fixture)/''',
        '''\.example$'''
    ]
    commits = ["abc123def456"]  # Specific commit to ignore

Inline allowlist in code:

    password = "test123"  # gitleaks:allow

## Tips

- Use `--redact` to hide actual secret values in output (for sharing reports)
- `gitleaks detect --log-opts="--all"` scans ALL branches and tags — always use this for thorough scans
- The `.gitleaks.toml` config file controls rules, allowlists, and custom patterns
- Combine with TruffleHog in CI: Gitleaks for speed, TruffleHog for verified credential checking

Help / Man page

    gitleaks [command] [flags]

    Commands:
      detect      Detect secrets in commits/files
      protect     Detect secrets in staged files (pre-commit)
      version     Print version

    detect flags:
      -s, --source PATH       Target path
      --no-git                Don't use git, scan files directly
      --log-opts STRING       Git log options
      -r, --report-path FILE  Output report file
      -f, --report-format     json, csv, junit, sarif
      --exit-code N           Exit code when leaks found (default: 1)
      -v, --verbose           Show all findings
      --redact                Redact secrets in output
      --config FILE           Config file path
      --max-target-megabytes  Max file size to scan

## Vue d’ensemble

Gitleaks détecte les secrets codés en dur dans les dépôts git et les systèmes de fichiers. Il scanne l’historique des commits, les fichiers en staging et les arbres de travail actuels à l’aide de plus de 150 règles intégrées pour les patterns de secrets courants. Il est plus rapide que TruffleHog pour l’intégration CI/CD et produit une sortie SARIF pour l’intégration IDE.

## Utilisation de base

    # Scanner un dépôt git local (historique complet)
    gitleaks detect --source /path/to/repo

    # Scanner le répertoire courant
    gitleaks detect

    # Scanner uniquement les fichiers en staging (pre-commit)
    gitleaks protect --staged

    # Scanner un dépôt distant
    gitleaks detect --source https://github.com/target/repo

    # Sortie verbeuse (afficher tous les résultats)
    gitleaks detect -v

## Formats de sortie

    # Par défaut (lisible par un humain)
    gitleaks detect --source /path/to/repo

    # Rapport JSON
    gitleaks detect --source /path/to/repo -r report.json

    # Rapport SARIF (pour GitHub Code Scanning)
    gitleaks detect --source /path/to/repo -f sarif -r report.sarif

    # Rapport CSV
    gitleaks detect --source /path/to/repo -f csv -r report.csv

## Modes de scan

    # Scanner tout l'historique git
    gitleaks detect --source /repo --log-opts="--all"

    # Scanner uniquement les commits récents (les 10 derniers)
    gitleaks detect --source /repo --log-opts="-10"

    # Scanner une branche spécifique
    gitleaks detect --source /repo --log-opts="--branches=main,develop"

    # Scanner entre deux commits
    gitleaks detect --source /repo --log-opts="abc123..HEAD"

    # Mode sans git (scanner les fichiers directement, sans historique git)
    gitleaks detect --no-git --source /path/to/files

## Intégration pre-commit

    # Scanner les fichiers en staging avant le commit
    gitleaks protect --staged

→ Retourne le code de sortie 1 si des secrets sont trouvés

    # Installer comme hook git
    cat > .git/hooks/pre-commit << 'EOF'
    #!/bin/sh
    gitleaks protect --staged --redact
    EOF
    chmod +x .git/hooks/pre-commit

## Intégration CI/CD

    # GitHub Actions
    - name: Gitleaks
      uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    # GitLab CI
    gitleaks:
      image: zricethezav/gitleaks:latest
      script:
        - gitleaks detect --source . -r gitleaks-report.json

    # CI générique
    gitleaks detect --source . --exit-code 1

## Règles personnalisées (.gitleaks.toml)

    [extend]
    useDefault = true   # Inclure les règles intégrées

    [[rules]]
    id = "custom-api-key"
    description = "Custom API Key"
    regex = '''(?i)myapp[_-]?key[_-]?=\s*['"]?([a-zA-Z0-9]{32})'''
    secretGroup = 1
    keywords = ["myapp", "api-key"]

    [[rules.allowlists]]
    description = "Ignore test files"
    paths = ['''test/''', '''spec/''']

## Allowlisting

    # .gitleaks.toml
    [allowlist]
    description = "Global allowlist"
    regexes = ['''EXAMPLE_KEY_123''']
    paths = [
        '''(test|spec|fixture)/''',
        '''\.example$'''
    ]
    commits = ["abc123def456"]  # Commit spécifique à ignorer

Allowlist inline dans le code :

    password = "test123"  # gitleaks:allow

## Conseils

- Utiliser `--redact` pour masquer les valeurs réelles des secrets dans la sortie (pour le partage de rapports)
- `gitleaks detect --log-opts="--all"` scanne TOUTES les branches et tags : toujours l’utiliser pour des scans exhaustifs
- Le fichier de config `.gitleaks.toml` contrôle les règles, allowlists et patterns personnalisés
- Combiner avec TruffleHog en CI : Gitleaks pour la vitesse, TruffleHog pour la vérification des identifiants

Aide / Page de manuel

    gitleaks [command] [flags]

    Commands:
      detect      Detect secrets in commits/files
      protect     Detect secrets in staged files (pre-commit)
      version     Print version

    detect flags:
      -s, --source PATH       Target path
      --no-git                Don't use git, scan files directly
      --log-opts STRING       Git log options
      -r, --report-path FILE  Output report file
      -f, --report-format     json, csv, junit, sarif
      --exit-code N           Exit code when leaks found (default: 1)
      -v, --verbose           Show all findings
      --redact                Redact secrets in output
      --config FILE           Config file path
      --max-target-megabytes  Max file size to scan