Betterleaks
+ ○
▾
Betterleaks is a configurable, fast, and thorough secrets scanner. It is maintained by the folks who made Gitleaks, including the original author.
Check out this series of blog posts to learn how the detection engine works: 1. Regex is all you need, 2. Rare Not Random, 3. Express YourCELf, 4. Better generic secrets detection.
Development is supported by
Notable Features
| Feature | Description |
|---|
| Simple Prioritization | Rank by confidence, validation status, and analyzed severity scores to make triage as simple as 123. |
| Secrets Validation | Validate if a detected secret is active by making asynchronous HTTP requests directly from within the rule definition using Expr. |
| Secrets Analysis | Enrich valid credentials with provider-neutral identity, account, capability, and severity information. |
| Secrets Revocation | Optionally revoke secrets. |
| Expr-based filtering | Write contextual rule filters that evaluate fragment (data chunks) attributes (like git author, commit message, and file path) and finding data to reduce false positives. |
| BPE filtering | Filter out natural language false positives by using BPE tokenization to measure how "rare" or non-human a string is. |
| Fast scans | Achieve fast performance through sane default parallelization settings, ahocorasick keyword filters, and re2. |
| New Sources | Support for sources like GitHub, GitLab, Hugging Face, S3, and more. It's easy to add new sources too! |
| Container Images | Scan all platforms, historical layers, configuration, and embedded attestations, with digest provenance and deleted/overwritten path reporting. See the container guide. |
| Portability | Runs on any modern OS/Arch. The small binary can be integrated in any system. |
Installation
The main branch is for v2 development. V1 maintenance and documentation live on the v1.x branch.
Upgrading from v1? See the v2 migration guide for CLI, config, report, and SDK changes.
Until the first stable v2 release, package managers and the Docker latest tag
may still provide v1. Use the migration guide's release candidate instructions
to try v2 before then.
# Package managers
brew install betterleaks
brew install --cask betterleaks/tap/betterleaks
# Fedora Linux
sudo dnf install betterleaks
# Containers (stable v2)
docker pull ghcr.io/betterleaks/betterleaks:v2
# Go
go install github.com/betterleaks/betterleaks/v2@latest
# Source
git clone https://github.com/betterleaks/betterleaks
cd betterleaks
make build
Stable v2 releases update the tap's betterleaks cask and Docker :v2 and
:latest tags. Homebrew core updates separately. To keep v1 installed alongside
v2, use brew install --cask betterleaks/tap/betterleaks@1 (command:
betterleaks-v1) or the Docker :v1 tag.
Usage
Scans detect secrets without credential provider requests by default. Use
-v / --validate to check credentials, or -a / --analyze to also resolve
identity and permissions. Analysis implies validation. Set BETTERLEAKS_VALIDATE=true or BETTERLEAKS_ANALYZE=true to enable these stages through the environment. Explicit flags override the corresponding variable.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
