메뉴
Run Gitleaks for hardcoded secrets detection in code and git history. Use when scanning for API keys, passwords, tokens, certificates, or sensitive credentials in source code and commit history.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/igbuend/grimbard --skill gitleaks명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
SOC 직업 분류 기준
| name | gitleaks |
| description | Run Gitleaks for hardcoded secrets detection in code and git history. Use when scanning for API keys, passwords, tokens, certificates, or sensitive credentials in source code and commit history. |
| allowed-tools | ["Bash","Read","Glob","Grep"] |
Ideal scenarios:
Complements other tools:
Do NOT use this skill for:
# Homebrew (macOS/Linux)
brew install gitleaks
# Binary download
wget https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks-linux-amd64
chmod +x gitleaks-linux-amd64
gitleaks-linux-amd64 /usr/local/bin/gitleaks
docker pull ghcr.io/gitleaks/gitleaks:latest
go install github.com/gitleaks/gitleaks/v8@latest
gitleaks version
# Scan current directory (git repo)
gitleaks detect
# Scan specific directory
gitleaks detect --source /path/to/repo
# Scan uncommitted changes only
gitleaks protect
# Scan with no banner/color (for CI)
gitleaks detect --no-banner --no-color
# Generate SARIF report
gitleaks detect \
--report-format sarif \
--report-path results.sarif
# With additional options
gitleaks detect \
--source /path/to/repo \
--report-format sarif \
--report-path results.sarif \
--no-banner \
--no-color \
--exit-code 0
# Redact secrets in output
gitleaks detect \
--report-format sarif \
--report-path results.sarif \
--redact
# Scan all commits
gitleaks detect --source /path/to/repo --verbose
# Scan specific commit range
gitleaks detect --log-opts="--since='2024-01-01'"
# Scan specific branch
gitleaks detect --source /path/to/repo --log-opts="origin/main"
# JSON output
gitleaks detect --report-format json --report-path results.json
# CSV output
gitleaks detect --report-format csv --report-path results.csv
# JUnit XML
gitleaks detect --report-format junit --report-path results.xml
Create .gitleaks.toml:
title = "Gitleaks Configuration"
[extend]
# Extend default config
useDefault = true
[[rules]]
id = "custom-api-key"
description = "Custom API Key Pattern"
regex = '''(?i)api[_-]?key['\"]?\s*[:=]\s*['\"]([a-z0-9]{32,})'''
keywords = ["apikey", "api_key"]
[[rules]]
id = "slack-webhook"
description = "Slack Webhook URL"
regex = '''https://hooks\.slack\.com/services/T[a-zA-Z0-9_]{8,}/B[a-zA-Z0-9_]{8,}/[a-zA-Z0-9_]{24,}'''
[[rules]]
id = "aws-access-key"
description = "AWS Access Key"
regex = '''AKIA[0-9A-Z]{16}'''
keywords = ["AKIA"]
[allowlist]
description = "Allowlist for false positives"
regexes = [
'''EXAMPLE_API_KEY''',
'''placeholder-secret''',
'''test-token-123'''
]
paths = [
'''.gitleaks.toml''',
'''README.md''',
'''docs/'''
]
gitleaks detect --config .gitleaks.toml
# With SARIF output
gitleaks detect \
--config .gitleaks.toml \
--report-format sarif \
--report-path results.sarif
# gitleaks:allow
api_key = "this-is-a-test-key-not-real"
password = "example-password" # gitleaks:allow
Create .gitleaksignore:
# Ignore specific findings by fingerprint
fingerprint:abc123def456
# Ignore files
tests/fixtures/secrets.txt
docs/examples/*.py
# Ignore commits
commit:a1b2c3d4e5f6
# Create baseline of existing findings
gitleaks detect --report-path baseline.json --report-format json
# Scan only new findings
gitleaks detect --baseline-path baseline.json
name: Gitleaks
on:
push:
branches: [main]
pull_request:
schedule:
- cron: '0 0 * * 0' # Weekly
jobs:
gitleaks:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # Full history for complete scan
- name: Run Gitleaks
uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} # Optional: for Gitleaks Pro
- name: Generate SARIF
if: always()
run: |
gitleaks detect \
--report-format sarif \
--report-path gitleaks.sarif \
--no-banner \
--no-color \
--exit-code 0
- name: Upload SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: gitleaks.sarif
category: gitleaks
- name: Upload Results
if: always()
uses: actions/upload-artifact@v4
with:
name: gitleaks-results
path: gitleaks.sarif
# Install pre-commit
pip install pre-commit
# Create .pre-commit-config.yaml
cat > .pre-commit-config.yaml << 'EOF'
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.21.2
hooks:
- id: gitleaks
EOF
# Install hook
pre-commit install
# Test
pre-commit run --all-files
# Create .git/hooks/pre-commit
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/bash
gitleaks protect --staged --verbose --redact
EOF
chmod +x .git/hooks/pre-commit
# Full history scan with SARIF output
gitleaks detect \
--source /path/to/repo \
--report-format sarif \
--report-path full-audit.sarif \
--verbose
# Review results
sarif summary full-audit.sarif
# Scan only uncommitted changes
gitleaks protect --staged --verbose
# If secrets found, prevent commit
gitleaks protect --staged --exit-code 1
# Baldwin.sh pattern
gitleaks dir \
--source /workspace/src \
--report-format sarif \
--report-path /workspace/output/sarif/gitleaks.sarif \
--no-banner \
--no-color \
--ignore-gitleaks-allow \
--exit-code 0
# 1. Initial scan
gitleaks detect --report-format json --report-path findings.json
# 2. Review and create baseline
gitleaks detect --report-path baseline.json --report-format json
# 3. Track only new leaks
gitleaks detect --baseline-path baseline.json --verbose
# 4. After cleanup, verify
gitleaks detect --exit-code 1 # Fail if any secrets found
Gitleaks SARIF v2.1.0 includes:
commit: Git commit hash (if applicable)file: File pathstartLine: Line numberendLine: Line numbermatch: Redacted or full secret (depending on --redact)secret: The detected secret (if not redacted){
"Description": "AWS Access Key",
"StartLine": 42,
"EndLine": 42,
"StartColumn": 15,
"EndColumn": 50,
"Match": "AKIA****************",
"Secret": "AKIA1234567890ABCDEF",
"File": "config/aws.py",
"SymlinkFile": "",
"Commit": "a1b2c3d4e5f6g7h8",
"Entropy": 4.5,
"Author": "developer@example.com",
"Email": "developer@example.com",
"Date": "2024-01-15T10:30:00Z",
"Message": "Add AWS configuration",
"Tags": [],
"RuleID": "aws-access-token",
"Fingerprint": "a1b2c3d4e5f6g7h8:config/aws.py:aws-access-token:42"
}
# Enable entropy scanning (experimental)
gitleaks detect --verbose --log-level debug
# Disable default rules, use custom only
gitleaks detect --config custom-rules.toml --no-default-config
# Scan only Python files
gitleaks detect --source /code --log-opts="--all -- '*.py'"
# Exclude vendor directories
gitleaks detect --source /code --log-opts="--all -- . ':!vendor'"
# Faster scans: limit git log depth
gitleaks detect --log-opts="--max-count=1000"
# Scan only recent commits
gitleaks detect --log-opts="--since='1 month ago'"
# Parallel processing (default)
gitleaks detect --source /large/repo
| Shortcut | Why It's Wrong |
|---|---|
| "Gitleaks found nothing = no secrets" | Obfuscated, encrypted, or dynamically constructed secrets are missed |
| "Only scan code, skip git history" | Secrets in history can still be exploited; attackers check git logs |
| "Disable in CI for speed" | Secret leaks are critical; speed should never compromise security |
| "Mark all as false positive" | Each finding needs review; some may be valid credentials |
| "Don't use --redact in reports" | Unredacted secrets in reports can leak to logs, artifacts, or dashboards |
Data visualization and information design best practices. Use when creating charts, dashboards, graphs, or any visual representation of data.
Typography principles for print and screen. Use when selecting fonts, setting type, designing text layouts, or creating web typography.
Reviews skills against Claude Code best practices. Use when auditing skill files for adherence to recommendations.