Gitleaks

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Gitleaks is the widely used open source scanner for hardcoded secrets. It reads source code, configuration files and git commit history and reports every hardcoded API key, cloud access key, token, password and private key it finds, using an embedded ruleset of more than 160 detection rules that recognise the credential formats of the major cloud and SaaS providers. This AMI delivers Gitleaks as a ready-to-run secret-scanning host: connect over SSH and the scanner, git and a scheduled scan are already in place, so you can scan a directory or a full repository history within seconds of launch.

## Two Complementary Scan Modes

Gitleaks scans in two modes that together catch far more than a working-tree grep. The git-history mode walks the entire commit history of a repository, so a secret that was committed once and later deleted is still caught - the exact case a working-tree scan misses. The directory mode scans plain files and working trees. Every finding names the rule, the file, the line, the commit and the offending value, and results can be written as JSON or SARIF for a code review, a dashboard or a pipeline gate.

## Runs Fully Offline

The detection rules are compiled into the scanner binary, so Gitleaks needs no network egress at all. This instance can sit in a locked-down subnet with no outbound internet and still scan every repository you give it - ideal for air-gapped and regulated environments where source code must never leave the network.

## Scheduled Scans And Machine-Readable Reports

A daily systemd timer scans a directory you choose and writes both JSON and SARIF reports, with latest.json and latest.sarif symlinks for CI pickup. SARIF is the format GitHub code scanning, AWS CodeCatalyst, Azure DevOps and most IDEs consume directly, so the reports drop straight into your existing tooling. The scan target, report directory, retention and an optional custom ruleset are all set in a single appliance configuration file.

## Prove It Yourself

Read-only self-test fixtures ship on the image: a leaky directory, a leaky git repository with a secret committed to history, and a clean directory. Running the scanner against them proves detection works on your own instance and demonstrates the documented exit-code contract that makes Gitleaks a reliable CI gate - exit 1 when a secret is found, exit 0 when the scan is clean.

## Ready To Use

Connect over SSH and everything is already installed. There is no web interface, no listening service, no admin account and no password - the SSH key you choose at launch is the only way in, and the shipped security group opens port 22 only. Compared to installing Gitleaks by hand, pinning a verified release, wiring up git-history scanning and building a scheduled scan with report rotation, this AMI eliminates the setup effort entirely.

## cloudimg Support

24/7 technical support by email and live chat. Our engineers help with directory and git-history scanning, the JSON and SARIF reports, the scheduled scan timer, custom rulesets and allowlists, the exit-code contract, and wiring Gitleaks into CI/CD pipelines and pre-commit hooks.

## Use Cases

• Scanning a repository's full git history for secrets that were committed and later deleted
• Adding a secret-detection gate to a CI/CD pipeline using the documented exit-code contract
• Auditing source code for hardcoded credentials in an air-gapped or regulated environment with no outbound internet

## Getting Started

1. Launch the AMI in your preferred AWS region

2. SSH into the instance as the default login user for your operating system

3. Scan the shipped self-test fixtures to confirm detection, then scan your own repositories

4. Point the scheduled scan at your project checkouts and collect the JSON and SARIF reports