Skip to content
secret-scan
Menu

How it works

How it works

The scanner finds raw matches. The filter turns each one into a finding with one verdict, or drops it through a reviewed exception. The gate reads one number.

  1. Step 1

    Generate the config

    generate-gitleaks-config.mjs writes generated.gitleaks.toml beside the script, built from the private value rules and the whole-file exceptions. It is never committed.

  2. Step 2

    Scan

    gitleaks scans the repository with that config and writes a JSON report. trufflehog is optional and writes NDJSON.

  3. Step 3

    Filter

    Run filter-gitleaks-output.mjs <report.json> with the cwd at the scanned repository root and git on PATH, or pipe trufflehog output into filter-trufflehog-output.mjs.

  4. Step 4

    Gate

    Fail the job when .summary.private is above zero. triage findings are listed for a human but do not fail it.

Fail toward reporting

For a finding under a line-bound exception, the gitleaks filter re-reads the source line from git objects, or from disk for a --no-git scan, and compares its line fingerprint.

Any doubt in that path reports the finding instead of suppressing it: a blank commit, a commit that is not a full SHA, an unreadable line, a missing git or any other git failure.

Put one clear gate behind your scanner

Four zero-dependency Node modules that run in your CI job. Nothing calls a service and there is no account.

Get startedRead the docs