Gitleaks rules¶
Boost Security scans repositories with a curated default Gitleaks configuration: the Gitleaks built-in rule set, plus custom rules maintained by Boost.
Configuration precedence¶
The Gitleaks scanner uses a single configuration for a repository: the first one found, in the following order:
- A
.gitleaks.tomlfile in the repository. - A Gitleaks scanner configuration set in Boost Security.
- The Boost Security curated default configuration.
The configuration that applies replaces the default configuration entirely; configurations are never merged. As a result, a Gitleaks scanner configuration set in Boost Security has no effect on a repository that contains its own .gitleaks.toml file.
Warning
A .gitleaks.toml file that isn't valid TOML, for example a list of paths written like an ignore file, leaves no rules active. The scan succeeds but reports no findings. To exclude paths from scanning, use a .boostignore file instead.
Extending Gitleaks rules¶
When you are configuring a custom Gitleaks rule set, you can either specify an entire rule set or use the Gitleaks extend feature. There are a few reasons you may want to extend the Gitleaks built-in rules:
- Add new detection rules.
- Extend an existing rule.
- Make a rule more strict (i.e., remove false positive).
The Gitleaks configuration documentation shows how to extend the configuration to address any of those cases.
title = "Custom Gitleaks configuration"
[extend]
useDefault = true
# Define rules here
Note
[extend] useDefault = true is supported both in a repository .gitleaks.toml file and in a Gitleaks scanner configuration set in Boost Security. It starts from the Gitleaks built-in rules.
Secrets Validity¶
Boost Security will test the secrets validity against any of the following public services. Note that, if corresponding Gitleaks rules are disabled in Boost Security Policy, secret validity will not be checked even if it's a supported service.
| SaaS | Gitleaks rule |
|---|---|
| Asana | - asana-client-secret |
| Datadog | - datadog-access-token |
| Dropbox | - dropbox-api-token - dropbox-long-lived-api-token - dropbox-short-lived-api-token |
| - facebook-access-token - facebook-page-access-token - facebook-secret |
|
| GitHub | - github-app-token - github-fine-grained-pat - github-pat - github-refresh-token |
| GitLab | - gitlab-pat |
| Heroku | - heroku-api-key |
| Hubspot | - hubspot-api-key |
| Mailgun | - mailgun-private-api-token |
| Sendgrid | - sendgrid-api-token |
| Slack | - slack-app-token - slack-bot-token - slack-config-access-token - slack-config-refresh-token - slack-legacy-bot-token - slack-legacy-token - slack-legacy-workspace-token - slack-user-token - slack-webhook-url |
| Square | - square-access-token |
| Stripe | - stripe-access-token |
| Telegram | - telegram-bot-api-token |
| - twitter-bearer-token - twitter-access-token |