Gitleaks, an open-source secret scanner.

In this article, we review Gitleak. You will learn:

1. What is Gitleaks?

2. Gitleaks configuration in awslabs/aidlc-workflows repo.

What is Gitleaks?

Gitleaks an open-source secret scanner for git repositories, files, and directories. With over 16 million docker downloads, 17k GitHub stars, 9 million GitHub Downloads, thousands of weekly clones, and over 700k homebrew installs, gitleaks is the most trusted open-source secret scanner among security professionals, enterprises, and developers. Gitleaks is maintained by Zach Rice.

Gitleaks-Action is the official Gitleaks GitHub Action. You can use it to automatically run a gitleaks scan on all your team's pull requests and commits, or run on-demand scans. For a short demonstration of Gitleaks-Action, you can check out this GIF or read about the features in the redme. If you are scanning repos that belong to a GitHub personal account, then no license key is required. If you are scanning repos that belong to a GitHub organization account, then you'll have to obtain a free license below.

Below is a usage example I found on gitleaks-actions.

name: gitleaks
on:
  pull_request:
  push:
  workflow_dispatch:
  schedule:
    - cron: "0 4 * * *" # run once a day at 4 AM
jobs:
  scan:
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} # Only required for Organizations, not personal accounts.

Gitleaks configuration in awslabs/aidlc-workflows repo.

I found this file - .gitleaks.toml in awslabs/aidlc-workflows repo and is defined as shown below:

# Gitleaks configuration
# https://github.com/gitleaks/gitleaks#configuration
 
title = "aidlc-workflows gitleaks config"
 
[extend]
# Extend the default ruleset (don't replace it)
useDefault = true
 
[allowlist]
description = "Global allowlist"
paths = [
    '''\.gitleaks-baseline\.json$''',
    '''uv\.lock$''',
]

The comment mentions https://github.com/gitleaks/gitleaks#configuration where you can learn about the available configuration options in this toml file.

There is also another file named — .gitleaks-baseline.json this was mentioned in the paths and has 212 LOC at the time of writing this code.

I took a closer look at json content in this baseline file and it looks like below:

[
 {
  "RuleID": "aws-access-token",
  "Description": "Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.",
  "StartLine": 340,
  "EndLine": 340,
  "StartColumn": 22,
  "EndColumn": 41,
  "Match": "AKIAABCDEFGHIJKLMNOP",
  "Secret": "AKIAABCDEFGHIJKLMNOP",
  "File": "tests/unit/t313-plugin-doctor-checks.test.ts",
  "SymlinkFile": "",
  "Commit": "8e365e4e13b356c8057bc265beefb95d8dc3f15b",
  "Link": "https://github.com/awslabs/aidlc-workflows/blob/8e365e4e13b356c8057bc265beefb95d8dc3f15b/tests/unit/t313-plugin-doctor-checks.test.ts#L340",
  "Entropy": 3.8841836,
  "Author": "Arden Packeer",
  "Email": "2102737+apackeer@users.noreply.github.com",
  "Date": "2026-08-23T10:24:01Z",
  "Message": "feat: plugin-extensible /aidlc --doctor checks via tools/\u003cplugin\u003e-doctor.ts (2.6.61) (#797)\n\nAn enabled plugin may ship an optional tools/\u003cplugin\u003e-doctor.ts check script; doctor discovers it selection-aware, spawns it via bun (no shell) with AIDLC_PROJECT_DIR/AIDLC_HARNESS_DIR/AIDLC_PLUGIN_NAME, and folds its JSON {checks:[{pass,label,fix?,severity?}]} into the report. Error-severity failures fail doctor (exit 1); advisory failures stay visible without changing the exit code; timeouts, spawn errors, bad JSON, and malformed entries become bounded fail-loud rows (50-row/256KiB/300-char caps).\n\nDisabled plugins stay inert. Findings flow into --doctor --export via the existing adaptLegacyResult merge. test-pro ships the reference script.\n\nCloses #796",
  "Tags": [],
  "Fingerprint": "8e365e4e13b356c8057bc265beefb95d8dc3f15b:tests/unit/t313-plugin-doctor-checks.test.ts:aws-access-token:340"
 },

well, I needed to understand what baseline meant here, so I took a closer look at README and found this section — Creating a baseline.

When scanning large repositories or repositories with a long history, it can be convenient to use a baseline. When using a baseline, gitleaks will ignore any old findings that are present in the baseline. A baseline can be any gitleaks report. To create a gitleaks report, run gitleaks with the --report-path parameter. — Source.

About me:

Hey, my name is Ramu Narasinga. Email: ramu.narasinga@gmail.com

I spent 3+ years studying OSS codebases and wrote 400+ articles on what makes the production-grade. Now I'm putting that into practice differently - instead of writing every fix myself, I run coding agents that do it.

How it works? Register your machine as a Runtime, point it at your repo. Agents pick up issues. write the fix, open the PR. You just review, they execute.

Build your coding agents and get more work done in less time at thinkthroo.com

References:

1. gitleaks.io/.

2. github.com/awslabs/aidlc-workflows/.gitleaks.toml.

3. github.com/gitleaks/gitleaks-action#v2-benefits.

4. github.com/gitleaks/gitleaks#configuration.

5. github.com/gitleaks/gitleaks#creating-a-baseline.