Learn how to – Gitleaks – How to Audit git repository for secrets.
Do you store unencrypted passwords, secrets and any other unwanted data types in your git source code repositories?. Gitleaks gives you a way to scan your git repositories for these unwanted data which should be private. The scans can be automated to fit perfectly into CI/CD workflow for secrets identification before they make it deeper into the codebase.
Gitleaks Features
Some of the cool features of Gitleaks include:
- Support for private repository scans as well as repositories that require key-based authentication
- Support for Gitlab bulk organization and repository owner (user) repository scans, and pull request scanning for use in common CI workflows.
- You can output the scan results in JSON and CSV and formats for consumption in other reporting tools and frameworks.
- Externalised configuration for environment specific customisation including regex rules
Customisable repository name, file type, commit ID,branchname and regex whitelisting to reduce false positives- High performance through the use of src-d’s go-git framework
How to Install Gitleaks on Linux
Gitleaks is written in Go and the binary file is available for many popular platforms and OS types from the releases page.
Step 1: Download Gitleaks on Linux | macOS
Check the latest release and save it to a variable like below.
For Linux Users
curl -s https://api.github.com/repos/zricethezav/gitleaks/releases/latest |grep browser_download_url | cut -d '"' -f 4 | grep 'linux-amd64$'| wget -i -
For macOS user:
curl -s https://api.github.com/repos/zricethezav/gitleaks/releases/latest |grep browser_download_url | cut -d '"' -f 4 | grep 'darwin-amd64$'| wget -i -
If you’re a Windows user, download and install gitleaks-windows-amd64.exe
Step 2: Install Gitleaks on Linux | macOS
Once the file is downloaded, give it executable bot and put it inside /usr/local/bin
mv gitleaks-linux-amd64 gitleaks
chmod +x gitleaks
sudo mv gitleaks /usr/local/bin/
For macOS:
mv gitleaks-darwin-amd64 /usr/local/bin/gitleaks
sudo chmod +x /usr/local/bin/gitleaks
Confirm that you can call the gitleaks command.
$ gitleaks --version
v7.5.0
How to Use Gitleaks to Audit Git repositories
Gitleaks has lots of tunables that you don’t actually need for basic usage. The default mode should work against a single repo without any tweaks.
$ gitleaks --repo-url=https://github.com/jmutai/dotfiles
INFO[2019-02-13T15:55:43+03:00] cloning https://github.com/jmutai/dotfiles
Enumerating objects: 42, done.
Counting objects: 100% (42/42), done.
Compressing objects: 100% (34/34), done.
Total 2255 (delta 10), reused 26 (delta 8), pack-reused 2213
INFO[2019-02-13T15:55:57+03:00] 0 leaks detected. 159 commits inspected in 13 seconds 389 milliseconds
To view the output of the audit as gitleaks processes the repository, use the -v
or --verbose
flags which turns on verbose mode.
$ gitleaks --repo-url=https://github.com/gitleakstest/gronit -v
INFO[0000] cloning... https://github.com/gitleakstest/gronit
Enumerating objects: 135, done.
Total 135 (delta 0), reused 0 (delta 0), pack-reused 135
{
"line": "const AWS_KEY = "AKIALALEMEL33243OLIAE""""
Leave a Reply
You must be logged in to post a comment.