gitleaks

Why we included this project

A hardcoded API key can turn into an unexpected cloud bill the day it leaks. Gitleaks scans git commit history, working trees, individual files, and piped stdin to catch credentials before they get pushed, and it ships as a single Go binary or Docker image that drops into existing CI/CD pipelines. Detection is regex based, so teams can add rules for their own internal token formats and service credentials without much effort. The project is feature complete and now receives only security patches, which for a scanning tool means a stable, predictable baseline rather than a moving target. For developers and security engineers who want to block leaks at the merge gate instead of discovering them later, it's a solid, no-frills choice.