gitleaks detect

gitleaks detect --source=. --verbose --redact

Detect secrets in the repository with gitleaks, scanning the code and git history for exposed credentials.

Run it in the CI/CD pipeline (and on the repo) when you want secret detection: gitleaks analyzes the code (and git history with --log-opts or full history) and reports findings — API keys, tokens, passwords, private keys — with the file and line. It's the reference secret detector (by Zach Rice): the pipeline check that blocks a merge with a new secret. In DevSecOps, gitleaks is the pipeline piece: the secret detected in the PR (or in history) is revoked and fixed.

Don't use it as complete detection: gitleaks detects patterns from its rules — secrets with custom formats (like organization keys) require custom rules. And watch out: scanning the full history (--log-opts=--all) is slow on large repos — the pipeline scans the PR diff (fast) and history in periodic scans. Findings from history (old secrets) require rotation (the compromised secret is revoked, not just removed from the repo). --redact hides the secret in output (pipeline logs).