Gitleaks

Scan git repositories for hardcoded secrets using the gitleaks binary.

Updated Feb 11, 2026
One-click install
npx skills add https://github.com/zzw4257/security-skills --skill gitleaks
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: Gitleaks
Source: https://github.com/zzw4257/security-skills/tree/main/skills/gitleaks
Command: npx skills add https://github.com/zzw4257/security-skills --skill gitleaks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps prevent sensitive information like API keys, passwords, and other secrets from being accidentally committed into your codebase.

Core Features & Use Cases

  • Secret Detection: Scans code repositories for hardcoded secrets.
  • Prevention: Integrates into development workflows to stop secrets from entering version control.
  • Use Case: Before pushing code changes, run Gitleaks to ensure no accidental secret exposure occurs.

Quick Start

Run the gitleaks command to scan the current directory for secrets.

Frequently Asked Questions about Gitleaks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my git repository for hardcoded secrets?

You can scan code for secrets by running the gitleaks command in your current directory to detect hardcoded sensitive information like API keys before committing changes to version control.

What is the best way to prevent accidental secret exposure in CI/CD pipelines?

The best way to prevent accidental secret exposure in CI/CD pipelines is to integrate gitleaks into your software development workflow to automatically scan and block code commits containing sensitive information.

Do I need to install any dependencies to scan code for secrets?

Yes, you need the gitleaks binary installed and accessible in your system's PATH environment variable to successfully scan code repositories for sensitive information and prevent hardcoded secrets.

Can I use this secret detection approach for infrastructure as code?

Yes, you can use gitleaks to scan infrastructure as code repositories for hardcoded secrets, ensuring sensitive data is detected and prevented from entering version control during software development.

What types of sensitive information can code security scanning detect?

Code security scanning with gitleaks detects hardcoded secrets within git repositories, specifically targeting sensitive information such as API keys, passwords, and other credentials accidentally committed into the codebase.