Why full history • Use cases • Input • Output • Pricing

Gitleaks Secret Scanner

Find hardcoded API keys, tokens, and credentials anywhere in a public repo's git history — not just its current files.

Verified live: a test repo with a fake GitHub PAT and AWS access key committed and never removed — this Actor caught both, correctly, with rule ID, file, line, and commit metadata. A companion test against a real clean repo (octocat/Hello-World) correctly returned zero findings.

Why full history

Deleting a secret from the latest commit does not remove it from git history — anyone who clones the repo can still dig it out of an old commit. Most scanners only check what's currently checked out. This one scans the full commit log by default, because that's where forgotten secrets actually hide.

Use cases

• Pre-open-source audit — scan a private repo for committed credentials before flipping it public.
• Onboarding/offboarding cleanup — sweep a repo's full history after a contractor or employee with credential access leaves.
• M&A / acquisition due diligence — check a target company's codebase for leaked keys before the deal closes.
• Incident response — after any credential is suspected leaked, confirm scope: which repos, which commits, which files.
• CI/CD gate — block merges that introduce new secrets, and periodically re-scan full history to catch what slipped through earlier.
• Vendor/contractor code review — scan third-party code before integrating it into your monorepo.
• Compliance evidence — produce an audit trail showing regular secret-scanning as part of SOC2 or ISO 27001 controls.

Input

Field	Type	Required	Notes
target	string	yes	Public git repo URL
scanMode	string	no	history (default, full commit log) or working-tree (current files only)
engine	string	no	gitleaks (default, pattern match only) or betterleaks (pattern match + optional live validation)
liveValidation	boolean	no	betterleaks engine only. Makes an authenticated HTTP request per match to confirm the credential is still active -- turns "this looks like an AWS key" into "this AWS key still works"
revealSecrets	boolean	no	Off by default — matched secrets are redacted (ghp_****...ab12)

{ "target": "https://github.com/owner/repo", "scanMode": "history", "engine": "betterleaks", "liveValidation": true }

Output

One row per real secret found (rule, file, line, commit, author, redacted value, severity, confidence, fingerprint, remediation guidance), plus one scan_summary row with totals by rule and severity. Redaction is on by default so this Actor's own output can't become a new leak.

Every scan also writes a SARIF 2.1.0 report (report.sarif, GitHub code-scanning compatible) and a self-contained HTML report (report.html) to the key-value store, linked from the summary row.

Engines

• gitleaks (default) — fast, no network calls beyond the clone itself, zero false-negative risk from a validation endpoint being unreachable.
• betterleaks — built by the original Gitleaks author. Same detection lineage, plus an opt-in live-validation step: when liveValidation is on, each matched secret is checked with a real authenticated request, and its confidence field becomes confirmed-live, invalid, unknown, or needs_validation instead of just confirmed (pattern match only). This is the difference between "a key-shaped string exists in this file" and "this key still opens something."

Sample output

One real finding from a live scan of a public test-fixture repo with intentionally committed fake credentials:

{
  "findingType": "secret",
  "target": "https://github.com/trufflesecurity/test_keys",
  "engine": "gitleaks",
  "ruleId": "aws-access-token",
  "severity": "high",
  "confidence": "confirmed",
  "remediation": "Rotate this credential immediately, then remove it from git history (git filter-repo / BFG) if it appeared in a prior commit -- deleting the file alone does not remove it from history.",
  "description": "Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.",
  "file": "new_key",
  "startLine": 2,
  "secret": "AKIA************ZAM2",
  "fingerprint": "c664d5332d5f24ac",
  "commit": "0416560b1330d8ac42045813251d85c688717eaf",
  "author": "counter",
  "commitDate": "2023-10-19T02:56:37Z",
  "entropy": 3.6464393,
  "scannedAt": "2026-08-01T15:19:53.394484+00:00"
}

Pricing

Pay per completed scan (Pay-Per-Event) — $0.49 per scan, charged once the scan finishes regardless of findings count. Failed scans (clone error) are never charged.

FAQ

Does it scan private repos? It clones whatever URL you give it, so yes if the Actor's run environment has access (pass credentials via target as an authenticated clone URL). Public repos work with no extra configuration.

Will it re-report the same secret every run? No — each finding gets a stable fingerprint (hash of rule + file + secret, independent of line number), so you can dedupe across repeated scans in your own pipeline.

What happens if the repo is huge? Full-history scanning is the default and the point of this Actor, but scan time scales with commit count, not just file count. Use scanMode: "working-tree" if you only need current-file coverage and want a faster/cheaper run.

Can I use this as a CI/CD gate? Yes — point it at the repo URL on a schedule or via webhook, and treat any severity: "critical" or "high" finding with confidence: "confirmed" (or "confirmed-live" on the betterleaks engine) as a merge blocker.

Why pay for this instead of running gitleaks myself for free? Fair question — gitleaks itself is free and open source. This Actor is for hosted, schedulable, API-callable scanning with structured output (SARIF + HTML + normalized JSON), full-history-by-default coverage, and the optional betterleaks live-validation engine, without standing up your own CI runner for it.

Related Actors

Part of a five-Actor security scanning catalog: Trivy Security Scanner (CVEs + secrets + misconfig in one pass), Syft SBOM Generator, Grype Vulnerability Matcher, OSV-Scanner Vulnerability Checker.