Secret scanner for Git repositories and files
Fast secret scanner for Git history, directories and stdin, with regex and entropy rules for API keys, tokens and passwords.
Gitleaks scans Git repositories (including their full history), plain directories or piped input for secrets. Its default configuration covers a long list of credential formats, and custom rules can be added in TOML.
It is commonly installed as a pre-commit hook and as a CI step to stop new secrets from reaching a repository, with baseline and allow-list options to manage existing findings.
MIT · MIT License · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: MIT.
No published advisory found for Gitleaks in GitHub repository advisories and OSV.dev. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Find, verify and analyse leaked credentials
Secret scanner with hundreds of credential detectors that can verify whether a found key is live, across Git, cloud storage, chat and more.
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Secrets, certificates and access management platform
Open-core platform to manage application secrets and environment variables across teams and infrastructure, with SDKs, a CLI and secret scanning.
Static analysis for infrastructure as code
Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.
