gitleaks

Gitleaks

Purpose

Use this skill to identify exposed secrets in approved repositories or source trees.

Phase Fit

• Primary: Vulnerability Analysis
• Secondary: Retest and Closure

Use When

• Need to review a repository or filesystem for exposed secrets.
• Need to validate source-control hygiene.
• Need a repeatable retest after secret cleanup.

Avoid When

• The repository or filesystem is out of scope.
• Output would expose more secret material than necessary.

Inputs

• Approved repository or directory path
• Output handling and redaction rules
• Scan depth aligned to the current question

Procedure

1. Scope the scan to the approved repository or path.
2. Triage matches for real secrets versus false positives.
3. Minimize exposure of raw secret values in notes and reports.
4. Tie confirmed leaks to realistic impact and credential scope.
5. Preserve the exact scan path for retest.

Command Syntax

Replace sample paths with approved in-scope repositories.

# Detect secrets in the current directory
gitleaks detect -s .

# Scan a local git repository with JSON report
gitleaks git /path/to/contoso-repo --report-path contoso-gitleaks.json --report-format json

# Scan only recent commits (last 50)
gitleaks git /path/to/contoso-repo --log-opts "HEAD~50..HEAD" --report-path contoso-gitleaks.json

# Scan staged files before commit
gitleaks detect --staged --source .

# Use custom rules configuration
gitleaks git /path/to/contoso-repo --config .gitleaks.toml

Evidence to Capture

• Confirmed secret exposure and its repository context
• Whether the secret appears active or historical
• Exact scan path used during validation

Safety Boundaries

• Redact or minimize raw secret material in evidence.
• Do not use exposed credentials beyond the explicit engagement scope.