Gitleaks for enterprise

Gitleaks is customized for use across multiple projects/enterprises. This project allows you to have a centralized detection rule management.

Architecture

When we use Gitleaks with "n" number of projects, the architecture will be similar to below.

With default gitleaks design

With customized gitleaks for enterprise design

Disclaimer !

base.toml

1. The description field in base.toml is mandatory & it should start with "Rule: "
2. The id field in [[rules]] in allowlist.toml is mandatory & it should be an integer
3. DO NOT edit id field in base.toml. All the whitelisting/allowlist id are dependent on it

# Sample rule structure

[[rules]]
    description = "Rule 99: New rule description here"
    regex = '''newrule-regex-here'''
    tags = ["rule-tag-1", "rule-tag-2"]

allowlist.toml

1. Except commits, all the below fields are regex matches.
2. The id field in [[rules]] is mandatory & it should be an integer
3. Folder structure
   1. rewanthtammana > gitleaks-demo-repo > allowlist.toml
   2. rewanthtammana > another-repo > allowlist.toml

# Rule specific allow lists
# Sample allowlist structure

[[rules]]
    id = "99"
    [rules.allowlist]
        commits = ["commit-id-here"]
        files = ['''keys/eGuardKey.id_dsa$''']

Usage

• By default all detection rules are in in base.toml
• Save your allowlist rules in allowlist/$USERNAME/$REPONAME/allowlist.toml
• python run.py -a <allowlist-file-path> > gitleaks.toml - Combines your repo specific allowlist.toml & base.toml to generate gitleaks.toml file
• Use the above generated gitleaks.toml as gitleaks repo scanning configuration file

python3 run.py -a allowlist/$USERNAME/$REPONAME/allowlist.toml > gitleaks.toml
gitleaks detect -c ./gitleaks.toml --source /path/to/repo -v

For further usage refer to, https://github.com/zricethezav/gitleaks

Contribution

You can add new rules to base.toml file. It's parent file.

[[rules]]
    description = "Rule <id here>: AWS Secret Key"
    regex = '''(?i)aws(.{0,20})?(?-i)['\"][0-9a-zA-Z\/+]{40}['\"]'''
    tags = ["key", "AWS"]

Installation

Linux machine

pip install -r requirements.txt
pyinstaller run.py --onefile
./dist/run #This binary can also be used