gitleaks: the commit date is not the scan time

Two clocks on one finding

A finding names a commit and a date. That date is when the commit was recorded in git. It is not when you scanned, and it is not when anyone used a credential. The scan time is the time of the job or the clock on the command you ran, and it belongs in the note even though the finding does not print it.

A commit from 2024 found in a scan today is an old commit, discovered today. Filing it as “leaked today” uses the wrong clock. Filing it as “used in 2024” uses the commit date as if it were an access log. It is neither.

The current tree is a third fact

Whether the matched line is still on the branch you have checked out is a separate look at that file. Write the result of that look on its own line. “Still present” and “not in this checkout” are both compatible with a commit date in the past. Do not let either one erase the commit date or the scan time.

What to file

File the rule id, the commit, the commit date, and the scan time, each labeled. File the fingerprint so the same match is not opened twice. If you checked the current file, say what you found. Do not write a sentence that has only one of the two times.

Worked case: a 2024 commit found today

A redacted finding shows commit 9c1e2b7, date 2024-03-11, file deploy/old-env.sh. The scan job ran at 2026-11-03T09:00:00Z. A draft says the key was used on 11 March 2024. The current checkout of that file does not contain the line.

The note lists the commit date, the scan time, and “line not in this checkout.” It does not say the value was used in 2024, and it does not say the finding is new because the scan was today. The match remains a match in that commit. Use of the value is not in the finding.

rule: <id on the finding>
commit: 9c1e2b7  commit date: 2024-03-11
scan time: 2026-11-03T09:00:00Z
current checkout: line not present
write: three facts
not: used on 11 March, and not leaked today