retour aux outils back to tools Ducklings

Gitleaks

Scanner de secrets rapide pour les dépôts git et les fichiers. Détecte les clés API, mots de passe, tokens et clés privées via plus de 150 règles regex avec sortie SARIF et JSON. Fast secret scanner for git repositories and files. Detects API keys, passwords, tokens, and private keys using 150+ regex rules with SARIF and JSON output.

↗ https://github.com/gitleaks/gitleaks

Overview

Gitleaks detects hardcoded secrets in git repositories and filesystems. It scans commit history, staged files, and current working trees using 150+ built-in rules for common secret patterns. It’s faster than TruffleHog for CI/CD integration and produces SARIF output for IDE integration.

Basic Usage

Scan a local git repository (full history)

gitleaks detect --source /path/to/repo

Scan current directory

gitleaks detect

Scan only staged files (pre-commit)

gitleaks protect --staged

Scan a remote repository

gitleaks detect --source https://github.com/target/repo

Verbose output (show all findings)

gitleaks detect -v

Output Formats

Default (human-readable)

gitleaks detect --source /path/to/repo

JSON report

gitleaks detect --source /path/to/repo -r report.json

SARIF report (for GitHub Code Scanning)

gitleaks detect --source /path/to/repo -f sarif -r report.sarif

CSV report

gitleaks detect --source /path/to/repo -f csv -r report.csv

Scanning Modes

Scan all git history

gitleaks detect --source /repo --log-opts="--all"

Scan only recent commits (last 10)

gitleaks detect --source /repo --log-opts="-10"

Scan specific branch

gitleaks detect --source /repo --log-opts="--branches=main,develop"

Scan between commits

gitleaks detect --source /repo --log-opts="abc123..HEAD"

No-git mode (scan files directly, no git history)

gitleaks detect --no-git --source /path/to/files

Pre-commit Integration

Scan staged files before commit

gitleaks protect --staged

→ Returns exit code 1 if secrets found

# Install as git hook
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/sh
gitleaks protect --staged --redact
EOF
chmod +x .git/hooks/pre-commit

CI/CD Integration

# GitHub Actions
- name: Gitleaks
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# GitLab CI
gitleaks:
  image: zricethezav/gitleaks:latest
  script:
    - gitleaks detect --source . -r gitleaks-report.json

# Generic CI
gitleaks detect --source . --exit-code 1

Custom Rules (.gitleaks.toml)

[extend]
useDefault = true   # Include built-in rules

[[rules]]
id = "custom-api-key"
description = "Custom API Key"
regex = '''(?i)myapp[_-]?key[_-]?=\s*['"]?([a-zA-Z0-9]{32})'''
secretGroup = 1
keywords = ["myapp", "api-key"]

[[rules.allowlists]]
description = "Ignore test files"
paths = ['''test/''', '''spec/''']

Allowlisting

# .gitleaks.toml
[allowlist]
description = "Global allowlist"
regexes = ['''EXAMPLE_KEY_123''']
paths = [
    '''(test|spec|fixture)/''',
    '''\.example$'''
]
commits = ["abc123def456"]  # Specific commit to ignore

Inline allowlist in code:

password = "test123"  # gitleaks:allow

Tips

  • Use --redact to hide actual secret values in output (for sharing reports)
  • gitleaks detect --log-opts="--all" scans ALL branches and tags — always use this for thorough scans
  • The .gitleaks.toml config file controls rules, allowlists, and custom patterns
  • Combine with TruffleHog in CI: Gitleaks for speed, TruffleHog for verified credential checking
Help / Man page 
gitleaks [command] [flags]

Commands:
  detect      Detect secrets in commits/files
  protect     Detect secrets in staged files (pre-commit)
  version     Print version

detect flags:
  -s, --source PATH       Target path
  --no-git                Don't use git, scan files directly
  --log-opts STRING       Git log options
  -r, --report-path FILE  Output report file
  -f, --report-format     json, csv, junit, sarif
  --exit-code N           Exit code when leaks found (default: 1)
  -v, --verbose           Show all findings
  --redact                Redact secrets in output
  --config FILE           Config file path
  --max-target-megabytes  Max file size to scan

Vue d’ensemble

Gitleaks détecte les secrets codés en dur dans les dépôts git et les systèmes de fichiers. Il scanne l’historique des commits, les fichiers en staging et les arbres de travail actuels à l’aide de plus de 150 règles intégrées pour les patterns de secrets courants. Il est plus rapide que TruffleHog pour l’intégration CI/CD et produit une sortie SARIF pour l’intégration IDE.

Utilisation de base

# Scanner un dépôt git local (historique complet)
gitleaks detect --source /path/to/repo

# Scanner le répertoire courant
gitleaks detect

# Scanner uniquement les fichiers en staging (pre-commit)
gitleaks protect --staged

# Scanner un dépôt distant
gitleaks detect --source https://github.com/target/repo

# Sortie verbeuse (afficher tous les résultats)
gitleaks detect -v

Formats de sortie

# Par défaut (lisible par un humain)
gitleaks detect --source /path/to/repo

# Rapport JSON
gitleaks detect --source /path/to/repo -r report.json

# Rapport SARIF (pour GitHub Code Scanning)
gitleaks detect --source /path/to/repo -f sarif -r report.sarif

# Rapport CSV
gitleaks detect --source /path/to/repo -f csv -r report.csv

Modes de scan

# Scanner tout l'historique git
gitleaks detect --source /repo --log-opts="--all"

# Scanner uniquement les commits récents (les 10 derniers)
gitleaks detect --source /repo --log-opts="-10"

# Scanner une branche spécifique
gitleaks detect --source /repo --log-opts="--branches=main,develop"

# Scanner entre deux commits
gitleaks detect --source /repo --log-opts="abc123..HEAD"

# Mode sans git (scanner les fichiers directement, sans historique git)
gitleaks detect --no-git --source /path/to/files

Intégration pre-commit

# Scanner les fichiers en staging avant le commit
gitleaks protect --staged

→ Retourne le code de sortie 1 si des secrets sont trouvés

# Installer comme hook git
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/sh
gitleaks protect --staged --redact
EOF
chmod +x .git/hooks/pre-commit

Intégration CI/CD

# GitHub Actions
- name: Gitleaks
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# GitLab CI
gitleaks:
  image: zricethezav/gitleaks:latest
  script:
    - gitleaks detect --source . -r gitleaks-report.json

# CI générique
gitleaks detect --source . --exit-code 1

Règles personnalisées (.gitleaks.toml)

[extend]
useDefault = true   # Inclure les règles intégrées

[[rules]]
id = "custom-api-key"
description = "Custom API Key"
regex = '''(?i)myapp[_-]?key[_-]?=\s*['"]?([a-zA-Z0-9]{32})'''
secretGroup = 1
keywords = ["myapp", "api-key"]

[[rules.allowlists]]
description = "Ignore test files"
paths = ['''test/''', '''spec/''']

Allowlisting

# .gitleaks.toml
[allowlist]
description = "Global allowlist"
regexes = ['''EXAMPLE_KEY_123''']
paths = [
    '''(test|spec|fixture)/''',
    '''\.example$'''
]
commits = ["abc123def456"]  # Commit spécifique à ignorer

Allowlist inline dans le code :

password = "test123"  # gitleaks:allow

Conseils

  • Utiliser --redact pour masquer les valeurs réelles des secrets dans la sortie (pour le partage de rapports)
  • gitleaks detect --log-opts="--all" scanne TOUTES les branches et tags : toujours l’utiliser pour des scans exhaustifs
  • Le fichier de config .gitleaks.toml contrôle les règles, allowlists et patterns personnalisés
  • Combiner avec TruffleHog en CI : Gitleaks pour la vitesse, TruffleHog pour la vérification des identifiants
Aide / Page de manuel 
gitleaks [command] [flags]

Commands:
  detect      Detect secrets in commits/files
  protect     Detect secrets in staged files (pre-commit)
  version     Print version

detect flags:
  -s, --source PATH       Target path
  --no-git                Don't use git, scan files directly
  --log-opts STRING       Git log options
  -r, --report-path FILE  Output report file
  -f, --report-format     json, csv, junit, sarif
  --exit-code N           Exit code when leaks found (default: 1)
  -v, --verbose           Show all findings
  --redact                Redact secrets in output
  --config FILE           Config file path
  --max-target-megabytes  Max file size to scan