Gitleaks

Secret scanning in git history

FreeCode review, testing & securitygithub.com

What it is

Scans git repositories, loose files and stdin for passwords, API keys and tokens. It walks full commit history using git log -p, so it finds credentials in old commits that were later deleted from the working tree. Runs as a CLI, pre-commit hook, Docker image or GitHub Action.

Why it earns a slot

The highest-value five-minute install on this list. An assistant pasting a live OPENAI_API_KEY or database URL into a committed config file is routine, and once pushed only history rewriting removes it.

Know before you commit

Entropy-based detection false-positives on hashes, lockfiles and test fixtures, so budget time for a .gitleaksignore baseline. The maintainer has declared it feature complete, security patches only.

Getting started

brew install gitleaks && gitleaks detect --source .

Field notes

0 from the community

Loading notes…

Field check

Unverified

Pricing snapshot

$0 forever, MIT open source; the official GitHub Action needs a free license key for organisation-owned repos, none for personal accounts

Snapshots move fast — verify at checkout, and post a field note if it changed.

Drop into your Lovable chat

Evaluate Gitleaks (https://github.com/gitleaks/gitleaks) for this project, then use it only if it fits what we are already building.
Context: Secret scanning in git history. Scans git repositories, loose files and stdin for passwords, API keys and tokens. It walks full commit history using git log -p, so it finds credentials in old commits that were later deleted from the working tree. Runs as a CLI, pre-commit hook, Docker image or GitHub Action.
Reviewer notes (general, not written for this codebase): The highest-value five-minute install on this list. An assistant pasting a live OPENAI_API_KEY or database URL into a committed config file is routine, and once pushed only history rewriting removes it.
Watch out for: Entropy-based detection false-positives on hashes, lockfiles and test fixtures, so budget time for a .gitleaksignore baseline. The maintainer has declared it feature complete, security patches only.
Pricing: $0 forever, MIT open source; the official GitHub Action needs a free license key for organisation-owned repos, none for personal accounts
Setup: brew install gitleaks && gitleaks detect --source .
Rules: treat the notes above as background only. Do not assume a theme, style, layout or feature that is not already in this project — inspect the existing code first and ask me before changing visual direction.

/api/public/tools/gitleaks

Neighbourhood

How Gitleaks sits against the rest of the atlas — swaps, companions and the tools builders actually save alongside it.

Instead of thisDependabot Playwright Stagehand Storybook test runner Testing Library Trivy Vitest Aikido Security Arcjet Bito

Also in Code review, testing & security

Aikido Security

aikido.dev

All-in-one AppSec scanner

Free tier + paidCode review, testing & security

Developer free forever: 2 users, 10 repos, 2 container images, 1 domain, 250k protected requests/mo, 10 AI autofixes/mo; Basic $300/mo base for 10 users and 100 repos; Pro $600/mo for 200 repos; Advanced $600/mo for 500 repos; Enterprise custom

Open dossier

Arcjet

arcjet.com

In-app rate limiting and bot defence

PaidCode review, testing & security

No free plan as of 2026; Individual $25/app/mo; Startup $299/app/mo; Growth $799/app/mo; usage fees on top at $5 per 1M requests plus per-feature rates such as $0.50 per 1M for bot detection; 15-day trial

Open dossier

Bito

bito.ai

AI PR review agent

PaidCode review, testing & security

Team $12/seat/mo annually or $15 monthly; Professional $20/seat/mo annually or $25 monthly; both include 5,000 lines reviewed per seat per month, overage $5 per 1,000 lines; Enterprise custom; 14-day trial

Open dossier

Browserbase

browserbase.com

Hosted headless browser cloud

Free tier + paidCode review, testing & security

Free: 1 browser hour/mo; Developer $20/mo with 100 browser hours then $0.12/hr; Startup $99/mo with 500 hours then $0.10/hr; Scale custom with 250+ concurrent browsers

Open dossier