Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Failed to load latest commit information.
Latest commit message
Commit time


Discover where your sensitive data has been leaked.

Very often it happens that when mocking/just starting out with a new project on github, sensitive data gets added. API keys, usernames, passwords and emails are easily added.... and then forgotten.

Use this tool to detect where the mistakes are in your repos.

It works by trying to find words like 'username', 'password', and 'email' and shortenings in quoted strings, config style or JSON format. It captures the value assigned to it (after meeting some conditions) for further work.

Run gittyleaks in a git repo and find out! (common usage patterns )


Best way is to use pip to install:

pip install gittyleaks    # for python 2
pip3 install gittyleaks   # for python 3

Now you have gittyleaks as a python executable available on your system.

Upgrades can be done by giving the -U flag; pip3 install -U gittyleaks.

Command line usage

The program can be simply called by gittyleaks. There are 4 types of arguments.

  • Arguments for solving a bad situation (not there yet)
  • Arguments for changing whether there is a hit
  • Arguments for cloning a repo
  • Arguments concerned with printing results

Note that all arguments mentioned below have a short one letter + dash (e.g. -delete -> -d) version.

Find out more by using gittyleaks -h at commandline, or read on.

Solving bad situations

There has yet to be found a way how to help the user do something about it. This guide can help in the mean time:


gittyleaks                               # default "smart" filter
gittyleaks --find-anything               # find anything remotely suspicious
gittyleaks --excluding $ . [ example ,   # exclude some string matches (e.g. `$` occurs)
gittyleaks --case-sensitive              # set it to be strict about case


# gittyleaks -l some-git-cloneable-link
gittyleaks -link

# gittyleaks -user githubusername -repo githubusername
gittyleaks -user kootenpv -repo yagmail

# Giving the -d option deletes the repo afterwards immediately

Printing results

gittyleaks --verbose              # longer output
gittyleaks --no-banner (-b)       # do not print banner
gittyleaks --no-fancy-color (-f)  # turn off colors


Deleting a cloned repo should also be added with perhaps adding the -d flag

Allow user to --find-anything rather than filtering

Allow subclassing and overwriting certain methods. Docs on that to follow.

The package will soon provide the best practice to remedy this issue based on

Quality improvements to the detection.

Implementing a best practice deployment git hook (i.e. automatically check we do not upload unwanted data, and break deployment if there is)

Tests, tests, tests


💧 Find sensitive information for a git repo






No releases published


No packages published