git
git
The gitleaks filter reads source lines from git objects to check line-bound exceptions.
For a finding under a line-bound exception, the filter runs git cat-file on the finding’s commit and file, takes the line, and compares its line fingerprint with the reviewed value.
git must be on PATH and the cwd must be the scanned repository root. Any git failure reports the finding.
More integrations
All integrations →- 01
gitleaks
gitleaks scans with the generated config; the gitleaks filter classifies its JSON report.
- 02
trufflehog
Pipe trufflehog’s NDJSON into the trufflehog filter.
- 03
GitHub Actions
A copy-paste job installs the package into a scratch directory, scans the full history, filters and fails on private findings.