Betterleaks Launches as an Open-Source Successor to Gitleaks
Summary
Betterleaks, an open-source successor to Gitleaks, scans files, directories and Git repositories for exposed secrets. Features include CEL validation, encoded-secret decoding and parallel scanning; its BPE-based method is reported at 98.6% recall on CredData.
Key points
- Betterleaks scans directories, files and Git repositories for exposed credentials and tokens using default or custom rules.
- Developer Zach Rice describes the tool as a successor to Gitleaks.
- Its BPE-based token-efficiency scanning is reported to achieve 98.6% recall on CredData, compared with 70.4% for entropy-based scanning.
- Other announced capabilities include CEL-based rule validation, automatic handling of doubly or triply encoded secrets, and parallelized Git scanning.
- The tool is implemented in Go without CGO or a Hyperscan dependency and is released under the MIT license.
- Planned features include scanning additional data sources, LLM-assisted classification and automatic secret revocation.
Article Details
- Event Type
- Release of Betterleaks, an open-source secrets-scanning tool intended as a successor to Gitleaks.
- Impact
- Betterleaks scans files, directories, and Git repositories for exposed secrets. The article reports features including CEL-based rule validation, BPE-based scanning with 98.6% recall on the CredData dataset, automatic decoding of encoded secrets, and parallelized Git scanning. Planned features include additional data sources, LLM-assisted analysis, and automated secret revocation.
People
Vendors
Tools
BetterleaksBetterleaks is a new open-source secret scanner that inspects directories, files, and Git repositories with default or customizable rules to detect valid secrets before attackers can find them.gitleaksDeveloped by Zach Rice (the author of Gitleaks) with support from Aikido and maintained under an MIT license, Betterleaks adds CEL rule validation, BPE-based token-efficiency scanning with 98.6% recall, a pure Go