Gitleaks Secret Scanner API — Git History Credential Detection

What is this Gitleaks Secret Scanner?

This Gitleaks secret scanner API scans the full git history of public repositories for hardcoded API keys, tokens, and credentials — not just current files. Powered by the open-source Gitleaks engine with 150+ detection rules. Use it for secret detection in CI/CD pipelines, pre-open-source audits, M&A due diligence, incident response, and compliance evidence (SOC2, ISO 27001).

Key search terms: Gitleaks, secret scanner, git secret detection, API key scanner, credential leak detector, git history scanner, DevSecOps secret scanning, hardcoded secrets finder, repository security scanner, leaked credentials detector.

Git Secret Detection Scanner — Key Capabilities

Capability	Description
Full Git History Scanning	Scans entire commit log by default — catches secrets deleted from current files but still in history
150+ Detection Rules	Detects AWS keys, GitHub tokens, Stripe keys, Slack tokens, and 146+ other credential patterns
Betterleaks Engine	Optional live validation — confirms whether detected secrets are still active/working
SARIF 2.1.0 Output	GitHub code-scanning compatible SARIF reports for CI/CD integration
HTML Reports	Self-contained HTML reports for human review
Fingerprint Dedup	Stable fingerprints per finding enable deduplication across repeated scans
Redaction by Default	Matched secrets are redacted in output — the scanner's own output can't become a new leak

Git Secret Scanner — Frequently Asked Questions

Q: What is Gitleaks? Gitleaks is an open-source tool by Gitleaks (formerly zricethejav) that scans git repositories for hardcoded secrets — API keys, tokens, passwords, and credentials. It uses 150+ regex and entropy-based detection rules.

Q: Why scan full git history instead of just current files? Deleting a secret from the latest commit does NOT remove it from git history. Anyone who clones the repo can dig it out of an old commit. Full-history scanning catches secrets that were committed and then (supposedly) removed.

Q: What types of secrets does this scanner detect? AWS access keys, GitHub/GitLab personal access tokens, Stripe API keys, Slack tokens, Google Cloud credentials, private keys, database connection strings, JWT secrets, and 140+ other credential patterns.

Q: Can I scan private repositories? Yes. Pass an authenticated clone URL as the target. Public repos work with no extra configuration.

Q: What is the betterleaks engine? Betterleaks is built by the original Gitleaks author. It adds optional live validation — making an authenticated HTTP request per match to confirm the credential is still active. Turns "this looks like an AWS key" into "this AWS key still works."

Q: Does it produce SARIF output? Yes. Every scan writes a SARIF 2.1.0 report (GitHub code-scanning compatible) plus a self-contained HTML report to the key-value store.

Q: Can I use this in CI/CD pipelines? Yes. Point it at your repo URL on a schedule or via webhook. Treat any severity: "critical" or "high" finding with confidence: "confirmed" as a merge blocker.

Q: How is this different from running gitleaks locally? This hosted version provides API-callable, schedulable scanning with structured output (SARIF + HTML + normalized JSON), full-history-by-default coverage, and optional betterleaks live validation — without standing up your own CI runner.

Q: What does the output look like? One JSON row per finding with rule ID, file, line, commit, author, redacted secret value, severity, confidence, fingerprint, and remediation guidance. Plus a scan summary with totals.

---

Why full history • Use cases • Input • Output • Pricing

Gitleaks Secret Scanner

Find hardcoded API keys, tokens, and credentials anywhere in a public repo's git history — not just its current files.

Verified live: a test repo with a fake GitHub PAT and AWS access key committed and never removed — this Actor caught both, correctly, with rule ID, file, line, and commit metadata. A companion test against a real clean repo (octocat/Hello-World) correctly returned zero findings.

Why full history

Deleting a secret from the latest commit does not remove it from git history — anyone who clones the repo can still dig it out of an old commit. Most scanners only check what's currently checked out. This one scans the full commit log by default, because that's where forgotten secrets actually hide.

Use cases

• Pre-open-source audit — scan a private repo for committed credentials before flipping it public.
• Onboarding/offboarding cleanup — sweep a repo's full history after a contractor or employee with credential access leaves.
• M&A / acquisition due diligence — check a target company's codebase for leaked keys before the deal closes.
• Incident response — after any credential is suspected leaked, confirm scope: which repos, which commits, which files.
• CI/CD gate — block merges that introduce new secrets, and periodically re-scan full history to catch what slipped through earlier.
• Vendor/contractor code review — scan third-party code before integrating it into your monorepo.
• Compliance evidence — produce an audit trail showing regular secret-scanning as part of SOC2 or ISO 27001 controls.

Input

Field	Type	Required	Notes
target	string	yes	Public git repo URL
scanMode	string	no	history (default, full commit log) or working-tree (current files only)
engine	string	no	gitleaks (default, pattern match only) or betterleaks (pattern match + optional live validation)
liveValidation	boolean	no	betterleaks engine only. Makes an authenticated HTTP request per match to confirm the credential is still active -- turns "this looks like an AWS key" into "this AWS key still works"
revealSecrets	boolean	no	Off by default — matched secrets are redacted (ghp_****...ab12)

{ "target": "https://github.com/owner/repo", "scanMode": "history", "engine": "betterleaks", "liveValidation": true }

Output

One row per real secret found (rule, file, line, commit, author, redacted value, severity, confidence, fingerprint, remediation guidance), plus one scan_summary row with totals by rule and severity. Redaction is on by default so this Actor's own output can't become a new leak.

Every scan also writes a SARIF 2.1.0 report (report.sarif, GitHub code-scanning compatible) and a self-contained HTML report (report.html) to the key-value store, linked from the summary row.

Engines

• gitleaks (default) — fast, no network calls beyond the clone itself, zero false-negative risk from a validation endpoint being unreachable.
• betterleaks — built by the original Gitleaks author. Same detection lineage, plus an opt-in live-validation step: when liveValidation is on, each matched secret is checked with a real authenticated request, and its confidence field becomes confirmed-live, invalid, unknown, or needs_validation instead of just confirmed (pattern match only). This is the difference between "a key-shaped string exists in this file" and "this key still opens something."

Sample output

One real finding from a live scan of a public test-fixture repo with intentionally committed fake credentials:

{
  "findingType": "secret",
  "target": "https://github.com/trufflesecurity/test_keys",
  "engine": "gitleaks",
  "ruleId": "aws-access-token",
  "severity": "high",
  "confidence": "confirmed",
  "remediation": "Rotate this credential immediately, then remove it from git history (git filter-repo / BFG) if it appeared in a prior commit -- deleting the file alone does not remove it from history.",
  "description": "Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.",
  "file": "new_key",
  "startLine": 2,
  "secret": "AKIA************ZAM2",
  "fingerprint": "c664d5332d5f24ac",
  "commit": "0416560b1330d8ac42045813251d85c688717eaf",
  "author": "counter",
  "commitDate": "2023-10-19T02:56:37Z",
  "entropy": 3.6464393,
  "scannedAt": "2026-08-01T15:19:53.394484+00:00"
}

Pricing

Pay per completed scan (Pay-Per-Event) — $0.49 per scan, charged once the scan finishes regardless of findings count. Failed scans (clone error) are never charged.

FAQ

Does it scan private repos? It clones whatever URL you give it, so yes if the Actor's run environment has access (pass credentials via target as an authenticated clone URL). Public repos work with no extra configuration.

Will it re-report the same secret every run? No — each finding gets a stable fingerprint (hash of rule + file + secret, independent of line number), so you can dedupe across repeated scans in your own pipeline.

What happens if the repo is huge? Full-history scanning is the default and the point of this Actor, but scan time scales with commit count, not just file count. Use scanMode: "working-tree" if you only need current-file coverage and want a faster/cheaper run.

Can I use this as a CI/CD gate? Yes — point it at the repo URL on a schedule or via webhook, and treat any severity: "critical" or "high" finding with confidence: "confirmed" (or "confirmed-live" on the betterleaks engine) as a merge blocker.

Why pay for this instead of running gitleaks myself for free? Fair question — gitleaks itself is free and open source. This Actor is for hosted, schedulable, API-callable scanning with structured output (SARIF + HTML + normalized JSON), full-history-by-default coverage, and the optional betterleaks live-validation engine, without standing up your own CI runner for it.

Related Actors

Part of a five-Actor security scanning catalog: Trivy Security Scanner (CVEs + secrets + misconfig in one pass), Syft SBOM Generator, Grype Vulnerability Matcher, OSV-Scanner Vulnerability Checker.

Testing

27 offline tests — python3 -m pytest tests/ (no network, no Apify runtime, no gitleaks/betterleaks binary).

tests/test_main_orchestration.py covers the main.py run-orchestration + billing contract that decides whether this PUBLIC pay-per-event actor charges correctly: the input gates (no target / unknown engine → not billed), the drop-not-billed honesty rules (CLONE_FAILED / SCAN_FAILED push ONE honest error record and are never charged), the Actor.charge("scan-completed") event firing exactly once per successful scan, secret redaction-by-default (with revealSecrets opt-in) so the actor's own output never becomes a new leak, severity bucketing, stable line-independent fingerprinting + dedup counts, betterleaks live-validation confidence, and the SARIF 2.1.0 + HTML report writes to the key-value store. Tests stub apify and monkeypatch _clone/_run_gitleaks/_run_betterleaks to deterministic leaves, exercising the real orchestration logic offline (identical pattern to the other lead-gen Actor suites).