# git-secrets

> Prevents committing passwords and sensitive information to git repositories using pattern matching and hooks

Stars: 13.4k · Language: Shell · License: Apache-2.0 · Categories: Git

- Repository: https://github.com/awslabs/git-secrets
- Page: https://www.trmn.sh/tools/git-secrets

## Install

- Homebrew: `brew install git-secrets`
- Make: `make install`

## Overview

git-secrets is a git plugin that scans commits, commit messages, and merge histories to prevent sensitive information from being committed to repositories. It uses configurable regular expression patterns to detect prohibited content like passwords, API keys, and other credentials before they enter the git history.

The tool operates through git hooks (pre-commit, commit-msg, and prepare-commit-msg) that automatically scan content during the commit process. When prohibited patterns are detected, the commit is rejected. It includes built-in AWS credential detection patterns and can scan for AWS Access Key IDs, Secret Access Keys, and account IDs. Users can also define custom patterns and secret providers for organization-specific credential formats.

Developers working with cloud services, DevOps teams, and security-conscious organizations would use git-secrets to add an automated layer of protection against credential leaks. The tool supports scanning entire repository histories with `git secrets --scan-history`, making it useful for auditing existing codebases before making repositories public. It can be configured globally to automatically protect all new repositories or applied selectively to specific projects.

### Installation

```bash
# via Homebrew
brew install git-secrets
```

```bash
# via Make
make install
```

## Alternatives

- [Git Extras](https://www.trmn.sh/tools/git-extras.md): A collection of extra git subcommands, including git-ignore, git-setup, git-changelog, git-release, git-effort, git-squash and git-pull-request. (Shell, 18.1k stars)
- [forgit](https://www.trmn.sh/tools/forgit.md): Interactive Git command wrapper using fzf for fuzzy selection of files, commits, branches, and more (Shell, 5.1k stars)
- [tig](https://www.trmn.sh/tools/tig.md): ncurses-based text-mode interface for browsing Git repositories and staging changes (C, 13.4k stars)
- [gh-dash](https://www.trmn.sh/tools/gh-dash.md): Terminal UI for GitHub that lists configurable pull request and issue sections, with vim-style hotkeys, custom actions, and a YAML config file. (Go, 12.7k stars)
- [git-lfs](https://www.trmn.sh/tools/git-lfs.md): Git extension for managing large files by storing them outside the repository with pointer files (Go, 14.6k stars)

## Guides

- [Find leaked secrets in a git repo with gitleaks](https://www.trmn.sh/guides/scan-repo-for-secrets-gitleaks): Scan git history and working files for API keys and tokens with gitleaks, allowlist false positives, add a pre-commit hook and run it in CI.

---

Canonical: https://www.trmn.sh/tools/git-secrets