💧 Find sensitive information for a git repo
Switch branches/tags
Nothing to show
Clone or download
Latest commit e6eba9c Sep 8, 2017
Type Name Latest commit message Commit time
Failed to load latest commit information.
gittyleaks fix printing of banner Oct 2, 2016
resources hopefully image works Aug 1, 2015
.gitignore minor readme, added gitignore, hopefully fixed -h default flag Jul 31, 2015
README.md Update README.md Sep 8, 2017
README.rst turned into python Jul 31, 2015
deploy.py updated readme and deploy script Aug 2, 2015
setup.cfg turned into python Jul 31, 2015
setup.py pep8 compliant Aug 23, 2015



Discover where your sensitive data has been leaked.

Very often it happens that when mocking/just starting out with a new project on github, sensitive data gets added. API keys, usernames, passwords and emails are easily added.... and then forgotten.

Use this tool to detect where the mistakes are in your repos.

It works by trying to find words like 'username', 'password', and 'email' and shortenings in quoted strings, config style or JSON format. It captures the value assigned to it (after meeting some conditions) for further work.

Run gittyleaks in a git repo and find out! (common usage patterns )


Best way is to use pip to install:

pip install gittyleaks    # for python 2
pip3 install gittyleaks   # for python 3

Now you have gittyleaks as a python executable available on your system.

Upgrades can be done by giving the -U flag; pip3 install -U gittyleaks.

Command line usage

The program can be simply called by gittyleaks. There are 4 types of arguments.

  • Arguments for solving a bad situation (not there yet)
  • Arguments for changing whether there is a hit
  • Arguments for cloning a repo
  • Arguments concerned with printing results

Note that all arguments mentioned below have a short one letter + dash (e.g. -delete -> -d) version.

Find out more by using gittyleaks -h at commandline, or read on.

Solving bad situations

There has yet to be found a way how to help the user do something about it. This guide can help in the mean time: https://help.github.com/articles/remove-sensitive-data/


gittyleaks                               # default "smart" filter
gittyleaks --find-anything               # find anything remotely suspicious
gittyleaks --excluding $ . [ example ,   # exclude some string matches (e.g. `$` occurs)
gittyleaks --case-sensitive              # set it to be strict about case


# gittyleaks -l some-git-cloneable-link
gittyleaks -link https://github.com/kootenpv/yagmail

# gittyleaks -user githubusername -repo githubusername
gittyleaks -user kootenpv -repo yagmail

# Giving the -d option deletes the repo afterwards immediately

Printing results

gittyleaks --verbose              # longer output
gittyleaks --no-banner (-b)       # do not print banner
gittyleaks --no-fancy-color (-f)  # turn off colors


Deleting a cloned repo should also be added with perhaps adding the -d flag

Allow user to --find-anything rather than filtering

Allow subclassing and overwriting certain methods. Docs on that to follow.

The package will soon provide the best practice to remedy this issue based on https://help.github.com/articles/remove-sensitive-data/.

Quality improvements to the detection.

Implementing a best practice deployment git hook (i.e. automatically check we do not upload unwanted data, and break deployment if there is)

Tests, tests, tests