Feature
Value rules before name rules
Rules on the shape of the value run before rules on the variable name, so a public-looking name never hides a private value.
A value rule matches the shape of the secret value itself, so it works on source, history and built artifacts. It is the only kind rendered into gitleaks rules.
A name rule matches a variable name, so it applies only where a name survives, such as env files and config pairs.
A JWT-shaped value is decided by the role claim in its decoded payload; a JWT with any other role falls through to the name rules and then to triage.
More features
All features →- 01
Three verdicts, one gate
Every finding gets exactly one verdict:
private,publicortriage. Onlyprivatefails the gate. - 02
Counts-only output
Reports carry counts, paths, lines, rule names and fingerprints. A raw secret value is never printed.
- 03
Reviewed exceptions
Two kinds of hand-reviewed rule stop known-safe findings: whole-file exceptions and line-bound exceptions.