Skip to content

All.gitleaks.how to guide

Gitleaks How to Guide#

How to run Gitleaks locally#

The easiest way to run Gitleaks locally is with Docker

  • First, pull the image:

    > docker pull zricethezav/gitleaks:latest

  • Scan git repositories for secrets (including git history)

    > docker run -v $(pwd):/path zricethezav/gitleaks:latest git /path -v -c /path/.github/gitleaks-rules.toml
        ○
        │╲
        │ ○
        ○ ░
        ░    gitleaks

7:52PM INF 1540 commits scanned.
7:52PM INF scanned ~51542901 bytes (51.54 MB) in 46.4s
7:52PM INF no leaks found

  • Scan directories or files for secrets

    > docker run -v $(pwd):/path zricethezav/gitleaks:latest dir /path -v -c /path/.github/gitleaks-rules.toml
        ○
        │╲
        │ ○
        ○ ░
        ░    gitleaks

8:00PM INF scanned ~23901530 bytes (23.90 MB) in 26.1s
8:00PM INF no leaks found

How to deal with false positives#

  • Some secrets are detected by Gitleaks that are not actually secrets but false positives

  • To deal with false positives, we can use the following methods:

  • Use inline comments to allow specific lines of code

> aws_access_key_id=*** # gitleaks:allow
  1. Add the fingerprint to the .gitleaksignore file
> cat .gitleaksignore
> ck.infra/infra/terraform/environments/preprod/ap-northeast-1/terraform.tfvars:rule3:429
> 93f292c3dfa2649ef91f8925b623e79546fa992e:README.md:aws-access-token:121
  1. Adjust the allowlists or rules in the gitleaks-rules.toml file to reduce false positives
> cat .github/gitleaks-rules.toml
title = "gitleaks config"

[[allowlists]]
description = "global allow lists"
paths = [
        # Gitleaks rules file.
        '''(^|.*/)gitleaks-rules\.toml$''',
        # Compressed files.
        '''.*\.(csv|txt)\.gz$''',
        # Zip files.
        '''.*\.zip$''',
        # Gitleaks ignore file.
        '''.gitleaksignore$''',
]
...
[[rules]]
        id = "rule2"
        description = '''AWS API Key'''
        regex = '''AKIA[0-9A-Z]{16}'''
        tags = ["secret"]

How to remove leaks from previous commits in PR#

  • When leaks are committed to a PR, they remain in the commit history even after removal
  • The Gitleaks GitHub Actions will fail due to these leaks in the commit history

  • We can remove leaks from the commit history using the following methods:

  • Option 1: Soft reset and combine all commits in the PR into a single commit

    • Use this method if you want to discard all commit history in the PR
    # Checkout the PR branch
> git checkout <PR-branch-name>

# Reset to the base commit but keep changes staged
> git reset --soft $(git merge-base HEAD master)

# Create a new commit with all changes
> git commit -m "<commit-message>"

# Force push to the remote branch
> git push -f

  • Option 2: Rebase and squash only the commits that contain the leaks

    • Use this method if you want to retain some commit history in the PR
    • See this guide for more details on how to rebase and squash commits