gitleaks: scan repository history and block secrets at commit time

History, not just the working tree

Deleting a key from the latest commit does not remove it from history. Anyone who clones the repository can check out the commit that added it. gitleaks walks every commit and matches each change against rules for cloud keys, tokens, and private keys, plus a generic high-entropy rule.

Running a history scan

Run from the repository root. --redact masks the secret in the report so the output itself is safe to paste into a ticket. Releases from 8.19 add gitleaks git and gitleaks dir; the older detect command still works and is shown here because most CI examples use it.

Snippet

gitleaks detect --source . --redact -v \
  --report-format json --report-path gitleaks.json

# working-tree only, for an exported folder
gitleaks detect --no-git --source export/ --redact

One finding, read field by field

The commit and author show when the secret arrived. The fingerprint is the stable identifier used to mark a finding as reviewed.

Snippet

Finding:     aws_access_key_id = REDACTED
Secret:      REDACTED
RuleID:      aws-access-token
Entropy:     3.684184
File:        deploy/old-env.sh
Line:        4
Commit:      9c1e2b7f4d3a
Author:      build-bot
Date:        2024-03-11T09:42:10Z
Fingerprint: 9c1e2b7f4d3a:deploy/old-env.sh:aws-access-token:4

Worked response and the pre-commit hook

The key belongs to an IAM user that still exists. Rotation comes first: deactivate the key, check CloudTrail for its last use, then delete it. Rewriting history is optional and disruptive; the key is dead either way once it is revoked.

A test fixture that looks like a key is added to .gitleaksignore by fingerprint, with a comment. The pre-commit framework then runs gitleaks on staged changes, so the next key is caught on a laptop instead of in CI.

Snippet

# .gitleaksignore
# fake key used by unit tests, reviewed 2026-10-30
3f0a9d1c2e11:tests/fixtures/env.sample:generic-api-key:2

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.2
    hooks:
      - id: gitleaks

Diagram

A leaked key from detection to closure

Scan history
Walk every commit with redaction on.
Command
```
gitleaks detect --source . --redact
```

Revoke

Deactivate the credential before anything else.

Command

aws iam update-access-key --access-key-id <id> --status Inactive --user-name build-bot

Record
Mark reviewed false positives by fingerprint.
File
```
.gitleaksignore
```
Prevent
Run the same rules on staged changes.
Command
```
pre-commit install
```

Check yourself

1. A key was removed in the latest commit. Why does gitleaks still report it?

2. What should happen first when a live cloud key is found?

3. Why use --redact?