leakwatch

What is Leakwatch?

Leaked API keys, tokens, and passwords are one of the most common causes of breaches. Leakwatch finds them across your codebase, full Git history, container images, and cloud storage — and then verifies whether each secret is still live, so you spend time on real incidents instead of triaging noise.

$ leakwatch scan fs .
[
  {
    "id": "0fc548d39e866fc47779ed3bdee3caf5",
    "detector_id": "github-token",
    "severity": "critical",
    "redacted": "****cdEF",
    "source": { "source_type": "filesystem", "file_path": "config.env", "line": 1 },
    "verification": { "status": "unverified" },
    "detected_at": "2026-07-16T05:20:12.397435+03:00",
    "entropy": 4.52
  },
  {
    "id": "adb4fe5fa4583bc9a37656e21522de8a",
    "detector_id": "database-connection-string",
    "severity": "critical",
    "redacted": "postgres://admin:****@db.prod.internal:5432/app",
    "source": { "source_type": "filesystem", "file_path": "config.env", "line": 2 },
    "verification": { "status": "unverified" },
    "detected_at": "2026-07-16T05:20:12.397452+03:00",
    "entropy": 4.39
  }
]

── Scan Summary ─────────────────────────────────
  Findings:        2
─────────────────────────────────────────────────

Output is JSON by default — pipe it to jq, or add --format table for a human-readable terminal view. Secret values are redacted by default and never written to disk or logs. See Security and Output formats.

Features

• 6 scan sources — filesystem, Git history (every commit), container images, AWS S3, Google Cloud Storage, Slack
• 64 built-in detectors + YAML custom rules (no Go code needed)
• 54 live verifiers (84.4%) — confirms whether a secret is still active, not just present
• 5 output formats — JSON, SARIF, CSV, terminal table, and GitHub inline annotations
• Drop-in distribution — GitHub Action (Marketplace), Docker image, Homebrew, go install, single static binary
• Secret-safe — redacted output by default; secrets are never logged or stored
• Fast & CI-ready — Aho-Corasick keyword pre-filter + Shannon entropy, concurrent worker pool, exit-code aware, SARIF → Code Scanning

Quick Start

# Homebrew (macOS/Linux)
brew install HodeTech/tap/leakwatch

# Go
go install github.com/HodeTech/leakwatch@latest

# Docker
docker run --rm -v "$(pwd):/scan" ghcr.io/hodetech/leakwatch:latest scan fs /scan

…or grab a prebuilt binary from the releases page. Then:

leakwatch scan fs .                         # scan the current directory
leakwatch scan git .                        # scan full Git history
leakwatch scan image nginx:latest           # scan a container image
leakwatch scan fs . --format sarif -o results.sarif   # SARIF for Code Scanning
leakwatch scan git . --only-verified        # only secrets confirmed live (CLI verifies by default)
leakwatch init                              # generate a .leakwatch.yaml

leakwatch scan s3 my-bucket --prefix config/
leakwatch scan gcs my-bucket --prefix secrets/
leakwatch scan slack --token xoxb-... --channels general,engineering
leakwatch scan repos https://github.com/org/a.git https://github.com/org/b.git --parallel 5
leakwatch scan git . --since-commit HEAD~1   # only new commits (great for CI)
leakwatch scan fs . --remediation            # include rotation steps & doc links

GitHub Action

Add secret scanning to any workflow in one line — published on the GitHub Marketplace:

- uses: actions/checkout@v4
- uses: HodeTech/Leakwatch@v1
  with:
    scan-type: fs        # fs | git | image

• format: github → findings appear as inline annotations on the pull request.
• format: sarif + sarif-upload: true → findings show up as Code Scanning alerts (needs permissions: security-events: write).
• scan-diff: auto (git scans) → scans only the commits a PR/push introduces.

Exit codes (used for CI gating): 0 no findings · 1 findings reported · 2 error · 3 interrupted (Ctrl-C/SIGTERM).

Full inputs and recipes: CI/CD Integration guide.

Is it still live?

Detection is only half the job — a key that was already rotated isn't an incident. For most secret types, Leakwatch makes a controlled, read-only API call to the provider to confirm status:

That's 54 of 64 detectors (84.4%) with verification. Verification is on by default for the CLI and off by default in the Action (to keep CI fast and offline) — flip it with no-verify.

Why Leakwatch?

The short version: Leakwatch is the only one of the three that is both permissively MIT-licensed and does live verification — plus container & cloud scanning and native SARIF, in one dependency-free binary.

[^gl]: The Gitleaks CLI is MIT; the official gitleaks-action runs under a commercial EULA and needs a (free) license key for organization accounts. [^th]: TruffleHog emits JSON / plain / GitHub-Actions output and has no native SARIF formatter. All three tools use Aho-Corasick pre-filtering, Shannon-entropy filtering, and support custom rules.

Detectors

64 built-in detectors across these categories, plus your own YAML custom rules:

Output formats

--format selects the output; --output/-o writes to a file instead of stdout.

Configuration

Generate a starter file with leakwatch init, or write .leakwatch.yaml:

scan:
  concurrency: 8
  max-file-size: 10485760        # 10 MB
detection:
  entropy: { enabled: true, threshold: 4.0 }
verification:
  enabled: true
  timeout: 10s
filter:
  exclude-paths: ["vendor/**", "node_modules/**", "**/*.lock"]
output:
  format: json
  show-raw: false

Use .leakwatchignore and # leakwatch:ignore markers to suppress known false positives. Details: Configuration guide.

Security

• Secret values are redacted by default (e.g. AKIA****MPLE) and are never written to disk or logs. The raw value is only emitted if you explicitly pass --show-raw.
• Verification uses controlled, read-only API calls to providers; it makes no state-changing requests.
• Found a vulnerability? Please report it privately via a GitHub security advisory.

Architecture

flowchart LR
    subgraph Sources["Sources (6)"]
        S1["Git"]
        S2["Filesystem"]
        S3["Container"]
        S4["AWS S3"]
        S5["GCS"]
        S6["Slack"]
    end
    subgraph Engine["Detection Engine"]
        E1["Aho-Corasick prefilter"]
        E2["Regex"]
        E3["Shannon entropy"]
    end
    subgraph Verify["Verification (54 verifiers)"]
        V1["Live API"]
        V2["Format validation"]
    end
    Sources -->|chunks| Engine
    Engine -->|findings| Verify
    Verify --> Output["JSON · SARIF · CSV · Table · GitHub"]

Deep dive: Architecture · ADRs

Documentation

Full bilingual (EN/TR) manuals are at hodetech.github.io/Leakwatch. Quick links:

Getting Started · Configuration · CI/CD · Custom Rules · Container Scanning · Cloud Scanning · Git Scanning · Slack Scanning · Verification · Docker · VS Code Extension · Roadmap

Contributing

Contributions are welcome — see CONTRIBUTING.md.

git clone https://github.com/HodeTech/Leakwatch.git
cd Leakwatch && go mod download && go test ./...

License

MIT © HodeTech — Leakwatch is maintained by HodeTech.