Gitleaks
securityUpdate 07/2026: Moved to the "Evaluation, Observability & Security" segment, where the security tooling now lives. Gitleaks is officially feature-complete - the maintainer merges no new features anymore, future releases are security patches only (last release v8.30.1, March 2026). The original author has started a successor project, Betterleaks, which we track separately.
Gitleaks remains stable and our recommendation for secret scanning stands unchanged. No migration needed - but evaluate the successor before building new, extensive custom-rule setups.
Gitleaks is a SAST tool for detecting hardcoded secrets in Git repositories. It integrates cleanly into development workflows via pre-commit hooks and CI/CD pipelines. Rules are defined using TOML files, allowing flexible regular expression patterns and contextual matching — including organization-specific configurations.
Recommendation: Embed Gitleaks into CI pipelines for any codebase involving LLMs or external APIs. Maintain custom rules and update detection patterns regularly to minimize false positives and blind spots.