gitleaks: Secret Detection across Working Trees, Git History, and CI Diffs
gitleaks scans files or Git patches with rules, regexes, entropy, and allowlists; after a finding, revoke and rotate first rather than merely deleting a file or rewriting history.