Detect Secrets in Git: Tools and Patterns (2026)

Install gitleaks

# macOS
brew install gitleaks

# Linux / Windows
# Download from https://github.com/gitleaks/gitleaks/releases
# or: go install github.com/zricethezav/gitleaks/v8@latest

Scan staged and tracked files

# Scan the current working directory (tracked files only)
gitleaks detect --source .

# Scan only files staged for the next commit
gitleaks detect --staged

This checks the files as they exist right now. It does not check history.

Walk the full git history

# Scan every commit reachable from the current HEAD
gitleaks git --source .

# Save the report as JSON (useful for CI and auditing)
gitleaks git --source . --report-path gitleaks-report.json

The output lists the secret type, the file, the commit SHA, and the first few characters of the value. If you see hits, rotate those credentials before doing anything else.

Set up the pre-commit framework

pip install pre-commit

Create .pre-commit-config.yaml in your repo root:

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.24.0
    hooks:
      - id: gitleaks

Then install the hook:

pre-commit install

From now on, every git commit runs gitleaks against the staged diff. If a secret matches, the commit is blocked and the output tells you what was found.

Test it works

Create a file with a fake secret pattern and try to commit it:

echo "STRIPE_SECRET_KEY=sk_live_faketest1234567890abcdef" > /tmp/test-secret.txt
git add /tmp/test-secret.txt
git commit -m "test"

Gitleaks should block the commit and print:

Finding:     STRIPE_SECRET_KEY=sk_live_fake...
Secret:      sk_live_fake...
RuleID:      stripe-api-key
Entropy:     3.58
File:        test-secret.txt

Delete the test file before continuing.

Create a baseline

pip install detect-secrets

# Scan and write a baseline of all current "secrets" (real and false positives)
detect-secrets scan > .secrets.baseline

Open .secrets.baseline in your editor. For each entry, decide: is this a real secret or a false positive? Mark false positives as audited:

detect-secrets audit .secrets.baseline

Commit the baseline file. Future scans flag only new secrets not in the baseline.

GitHub Actions workflow

Add this to .github/workflows/secret-scan.yml:

name: Secret Scan
on: [push, pull_request]

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0          # full history for history scan
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

fetch-depth: 0 is required. Without it, Actions does a shallow clone and gitleaks only sees the tip commit, missing everything in history.