gitleaks

ماذا يفعل

طريقة الكتابة

gitleaks git [PATH] [OPTIONS]
gitleaks dir [PATH] [OPTIONS]
gitleaks protect --staged

الأجزاء الرئيسية

Commands

git [PATH]

Scan the Git history of a repo.

dir [PATH]

Scan files (no Git needed).

stdin

Scan text from a pipe.

protect --staged

Scan staged changes (pre-commit; older name, still used).

الأكثر استخدامًا

لا يوجد شيء يطابق هذا الفلتر.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1. 1Scan a repo's full history

   $gitleaks git -v --redact .

2. 2Scan a folder that is not a repo

   $gitleaks dir --redact ./config

3. 3Only recent commits

   $gitleaks git --log-opts="--since=2026-10-01" .

4. 4Stop secrets before commit

   $cat .pre-commit-config.yaml
   repos:
     - repo: https://github.com/gitleaks/gitleaks
       rev: v8.21.2
       hooks:
         - id: gitleaks
   $pre-commit install

5. 5Use it in GitHub Actions

   $cat .github/workflows/secrets.yml
         - uses: actions/checkout@v4
           with: { fetch-depth: 0 }
         - uses: gitleaks/gitleaks-action@v2
           env: { GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" }

6. 6Report as SARIF

   $gitleaks git -f sarif -r gitleaks.sarif --redact .

7. 7Add your own rule and an allow list

   $cat .gitleaks.toml
   [extend]
   useDefault = true
   [[rules]]
   id = "s0sta-installer-key"
   description = "Installer key"
   regex = '''INSTALL_KEY\s*=\s*['"][a-f0-9]{32}['"]'''
   [allowlist]
   paths = ['''docs/examples/''']

8. 8Accept old findings with a baseline

   $gitleaks git -r baseline.json -f json .
   $gitleaks git --baseline-path baseline.json .

9. 9Scan text from a pipe

   $kubectl get configmap app -o yaml | gitleaks stdin --redact

10. 10After a leak: rotate, then clean history

    $git filter-repo --replace-text expressions.txt
    $git push --force-with-lease --all

لا يوجد شيء يطابق هذا الفلتر.

الملفات

.gitleaks.toml

Rules and allow lists.

.gitleaksignore

Fingerprints of accepted findings.

رموز الخروج