A git-aware secret & .env leak guard for TypeScript/Node.
Sub-second pre-commit scanning with the lowest false-positive rate —
so your team actually keeps it enabled.
$ git commit -m "add billing" ✖ leaklatch: 1 potential secret detected src/stripe.ts CRITICAL stripe-secret-key src/stripe.ts:12 match: sk************34 fix: Roll the key in the Stripe dashboard immediately. commit aborted.
Why leaklatch
The incumbents (gitleaks, detect-secrets, trufflehog) are great, broad tools. leaklatch wins where it counts for day-to-day work: speed, DX, and staying quiet unless it's real.
Scans only your staged diff, so it never slows down a commit.
Layered rules + entropy + placeholder filters mean it stays quiet unless it's real.
One command installs the hook. No YAML, no baseline required to start.
No network calls, no telemetry. Your code and secrets never leave your machine.
Inline // leaklatch-ignore, a config file, and a fingerprint baseline for gradual adoption.
--json output, a copy-paste GitHub Action, and a programmatic API.
How it works
Regex-only scanners flag anything that looks like a secret. leaklatch runs every candidate through layered validation before it ever becomes a finding.
Where a credential has a distinctive prefix (ghp_,
sk-ant-, AKIA…,
sk_live_), the rule requires it — no guessing from shape.
Generic assignments like API_KEY=… must clear an entropy
threshold, so API_KEY=changeme never fires.
Known placeholders (xxxx,
your-key-here, <token>,
${VAR}), example values, and test/fixture paths are skipped.
A long lowercase word isn't a secret just because it's long. File paths and camelCase identifiers (a classic false positive) are rejected; real credential material mixes character classes.
A single leaked value matched by several rules is reported once, under the most specific rule. Lock files and binaries are skipped entirely.
Usage
No global install needed. Works with plain git hooks and husky alike.
Install the pre-commit hook
# in your repo — installs an # append-safe pre-commit hook $ npx leaklatch install # every commit now scans staged changes
Scan on demand
$ npx leaklatch scan # staged diff $ npx leaklatch scan --all # whole tree $ npx leaklatch scan --json # for CI $ npx leaklatch scan --verbose # details
Drop into GitHub Actions
name: secret-scan on: [push, pull_request] jobs: leaklatch: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: { node-version: 20 } - run: npx leaklatch scan --all
Or embed the API
import { scan } from 'leaklatch'; const result = scan({ all: true }); if (result.findings.length) { process.exit(1); // fail CI }
Exit codes: 0 clean · 1 findings ·
2 not a git repo. Reverse the hook any time with
leaklatch uninstall.
Configuration
Drop a leaklatch.config.json in your repo root to customise
behaviour. Everything below is optional.
| Field | Purpose |
|---|---|
| ignorePaths | Substrings or globs (*, **) of paths to skip entirely. |
| disabledRules | Rule ids to turn off. |
| entropyOverrides | Per-rule entropy thresholds, keyed by rule id. |
| genericEntropyThreshold | Floor for the generic high-entropy detector. |
| disableGenericEntropy | Turn off the generic entropy detector. |
| customRules | Your own regex rules (id + regex required). |
Inline ignores
// leaklatch-ignore const legacy = 'sk_live_...'; // leaklatch-ignore // leaklatch-ignore-next-line const knownSafe = '...';
Baseline (adopt on an existing repo)
# accept current findings so only # NEW secrets block commits $ leaklatch scan --all \ --update-baseline # writes .leaklatch-baseline.json
Comparison
gitleaks, detect-secrets, and trufflehog are excellent tools. leaklatch's edge is TS-native DX and a far lower noise floor.
| leaklatch | gitleaks | detect-secrets | trufflehog | |
|---|---|---|---|---|
TS/Node-native, npx install |
✓ | Go | Python | Go |
| Zero-config default | ✓ | partial | baseline | partial |
| Scans staged diff (fast pre-commit) | ✓ | ✓ | partial | partial |
| Layered false-positive filtering | ✓ | partial | ✓ | partial |
| Inline ignore directives | ✓ | ✓ | partial | — |
| Programmatic API | ✓ | — | partial | — |
Coverage
A focused, high-signal rule pack — plus a generic entropy net and committed .env detection.
FAQ
No. leaklatch runs entirely on your machine — it shells out to git
and scans locally. There are no network calls and no telemetry. Nothing about your code
ever leaves your device.
Yes — MIT licensed and open source. Use it in personal and commercial projects freely.
Those are excellent, broad, binary-based tools. leaklatch is built for the TypeScript
developer's inner loop: it installs with npx, needs zero config,
runs in well under a second on a staged diff, and is tuned specifically to minimise false
positives — the number-one reason teams disable secret scanning.
You have three escape hatches: an inline // leaklatch-ignore
comment, an ignorePaths/disabledRules
entry in leaklatch.config.json, or a fingerprint baseline via
leaklatch scan --update-baseline. If you hit a false positive that
should never fire, please open an issue — those reports directly improve the filters.
Yes. leaklatch install is append-safe: if you already have a
pre-commit hook (including husky's), it inserts a clearly delimited block and leaves the rest
untouched. leaklatch uninstall removes only that block.
Node 18+. Tested in CI on Node 18, 20, and 22.
Absolutely. Run leaklatch scan --all --json in your pipeline; it
exits non-zero when a secret is found. A ready-to-copy GitHub Action is in the docs above.
One command. Zero config. Your secrets stay out of git.