gitleaks project
gitleaks
gitleaks scans with the generated config; the gitleaks filter classifies its JSON report.
generate-gitleaks-config.mjs writes generated.gitleaks.toml from the private value rules and the whole-file exceptions. Run gitleaks detect --source . --config <that file> --report-format json --exit-code 0, then the gitleaks filter on the report.
--exit-code 0 keeps gitleaks from failing the job on raw matches; the gate on .summary.private decides instead.
If gitleaks logs “0 commits scanned”, a global git config may be in the way: prefix the command with GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null.
More integrations
All integrations →- 01
trufflehog
Pipe trufflehog’s NDJSON into the trufflehog filter.
- 02
GitHub Actions
A copy-paste job installs the package into a scratch directory, scans the full history, filters and fails on private findings.
- 03
GitHub Packages
@catesworks/secret-scanis a restricted package on GitHub Packages, not on the public npm registry.