gitleaks: a directory scan has no commit

The mode is part of the result

gitleaks can walk commits, or it can read the files in a directory without treating them as history. A finding from the directory mode names a file and a rule. It does not name a commit, because that scan did not visit commits. The absence of a commit is the mode, not a broken report.

A history scan’s finding has a commit and a date. Those fields are not optional decoration. If they are missing, you are not looking at a history result, or the paste dropped them. Say which, once you know.

The file is the working tree or the export

The path on a directory-mode finding is a file that was on disk for that scan. It is not a path “still in git history.” Deleting the file after the scan does not create a historical commit you did not record. The finding remains a match in that folder at scan time.

Do not copy a commit hash from a different scan of the same repository onto this finding so the ticket looks complete.

What to file

File the rule id, the file, the line, the scan time, and the mode: history or directory. If the mode was directory, write “no commit on this finding.” If you are unsure because the paste is partial, write “mode not recorded” and do not add a hash.

Worked case: a folder export filed as history

A lab export of a docs folder is scanned as files on disk. The finding is rule generic-api-key, file notes.txt, line 4, no commit field. A draft adds commit 9c1e2b7 from an older history scan of a different path and says the secret remains in history.

The note says directory mode, no commit, file notes.txt at scan time. The older hash stays on its own finding. This match is not described as history. If someone later scans the git history, that is a new result with its own commit field.

mode: directory
rule: generic-api-key
file: notes.txt  line: 4
commit: none on this finding
scan time: 2026-11-03T09:00:00Z
not: commit 9c1e2b7, and not "still in history"