Feature
Reviewed exceptions
Two kinds of hand-reviewed rule stop known-safe findings: whole-file exceptions and line-bound exceptions.
A whole-file exception (ALLOWLIST_PATHS) is a path regex that drops every finding in a matching file. It is for files that hold secret-shaped text by design: tests, fixtures, scanner sources and docs.
A line-bound exception (ALLOWLIST_FINDINGS) is a path regex plus a reviewed line fingerprint. It suppresses one gitleaks finding only on that exact source line, counted as allowlistedFindings.
A line-bound exception hashes the line, not the matched value: rules that match only a prefix would give every key with that prefix the same value hash, so a real key pasted into the same file would collide with the reviewed placeholder.
More features
All features →- 01
Three verdicts, one gate
Every finding gets exactly one verdict:
private,publicortriage. Onlyprivatefails the gate. - 02
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
- 03
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.