Does servasec support Gitleaks custom rules?

Yes. Gitleaks custom rules are defined in your .gitleaks.toml and produce standard JSON output that servasec can ingest.

Can I scan private repositories?

Yes. Gitleaks runs locally against your git repository, so it works with private repos. Only the results (not the source code) are sent to servasec.

Supported/Secrets

Gitleaks + servasec

Detect hardcoded secrets like passwords, API keys, and tokens in Git repositories. Fast, regex-based scanning.

What is Gitleaks?

Gitleaks is a SAST tool for detecting and preventing hardcoded secrets in git repos. It uses regex patterns to identify secrets like API keys, passwords, tokens, and other sensitive information that may have been accidentally committed. Gitleaks can scan entire git history, making it ideal for both pre-commit hooks and full repository audits.

Regex-based secret detectionFull git history scanningPre-commit hook supportCustom rule definitionsEntropy-based detection

Integrate Gitleaks with servasec

Install Gitleaks

Install Gitleaks via Homebrew, Docker, or binary release.

brew install gitleaks

Scan your repository

Run Gitleaks against your repo and output JSON.

gitleaks detect --source . --report-format json --report-path results.json

Push to servasec

Send the results to servasec for centralized tracking.

curl -X POST "$SSC_PUBLIC_URL/api/ingest" \
  -H "X-Api-Token: $API_TOKEN" \
  -F "[email protected]"

What servasec adds to Gitleaks

Historical tracking

Track secret detection trends across commits and releases.

Severity classification

Automatic severity assignment based on secret type and risk level.

Assignment workflow

Assign detected secrets to team members for remediation.

Try Gitleaks with servasec

Self-host servasec and connect Gitleaks in minutes. AGPLv3 licensed, full data ownership.