Gitleaks and the Secrets Git Remembers (Series #Software)

A backpack and a mug. Zach Rice remembers getting that feedback from an Australian consulting firm before Gitleaks 1.0. The gifts came with a letter: they were already running hundreds of gigabytes of repositories through his scanner. It all started in 2018 with after-work experiments in Kali Linux and a desire to learn Go.

In a ten-minute CultRepo documentary, Rice tells how it became a tool that made its way into GitLab pipelines. The most interesting turn came when a contributor told him Gitleaks was trying to do too much. Rice cut features and focused on one job: finding secrets locally, without network requests.

Why use a scanner like this? Suppose you commit a working API key, notice it, and delete the line in the next commit. Open the file and it looks clean. Open the previous commit and the key is still there. In git mode, Gitleaks reads patches from git log -p and looks for strings resembling tokens, passwords, and private keys. You can scan the history of an existing repository and run a check in CI for new changes. You still need to revoke a leaked key.

There’s a sequel. In March 2026 Rice introduced Betterleaks. He says that by then he no longer had full control of the Gitleaks repository or name. The Gitleaks README now promises security fixes only. Aikido Security supports both the new project and the film.

Betterleaks can search beyond files and Git history. The scanner can read pull request comments on GitHub, CI logs in GitLab, and S3 objects. You can tune rules more precisely, for example by filtering findings by path or commit author. When you need to know whether a token is active, you can separately enable a check with the provider for supported types.

If Gitleaks already catches the key types you need and doesn’t slow the build, I’d keep it. Betterleaks is worth trying when secrets also turn up in comments or logs, or when the team spends time manually checking whether each token is live. Start by running both scanners over the same commit range and comparing findings, false positives, and run time.

As of November 6, 2026, Betterleaks 1.x is the stable line and 2.0 is still in prerelease. If the scanner is already part of CI, check the flags and report format before switching. In 2.0, for example, -v enables network-based token verification. In Gitleaks and Betterleaks 1.x the same flag just makes the output more verbose.

If you have only a couple of minutes, start at 5:27. Rice explains how the community helped him decide which features to cut even though users had got used to them.

#Software #Security #DevSecOps #DevTools #OpenSource