Feature
Fail toward reporting
Any doubt in the suppression path reports the finding instead of suppressing it.
Before it suppresses a finding under a line-bound exception, the gitleaks filter re-reads the source line from git (or from disk for a --no-git scan) and compares its line fingerprint.
A blank commit, a commit that is not a full SHA, an unreadable line, a missing git or any other git failure reports the finding.
The filter locates the repository from the cwd alone: inherited git variables that would redirect it are stripped, and a caller-set GIT_DIR or any .git entry in the cwd or an ancestor means the scan is never treated as non-git.
More features
All features →- 01
Three verdicts, one gate
Every finding gets exactly one verdict:
private,publicortriage. Onlyprivatefails the gate. - 02
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
- 03
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.