Get Started
← Go dark · Mission 12 of 17

Scan every app you built with AI for leaked API keys, before someone else does

AI coding tools love pasting API keys straight into your code, and deleting them later doesn't delete them from Git. Gitleaks digs through every old version of your project for OpenAI, Stripe, AWS and GitHub keys, and blocks new ones before they're committed. Free, open source, and it runs on your own PC.

30 minBeginnerTools: FreeStep 1 free
Tested 9 Oct 2026 · Gitleaks 8.30.1, Git 2.52, git-filter-repo 2.47, Windows PowerShell 5.1, Windows 11
Gitleaks set upa free scanner that knows 222 kinds of key, token and password
A practice project that shows 5 hidden leaks in under a minute, then a scan of your own projects' entire history
A pre-commit hook that blocks a key before it ever gets committed
  • A clear plan for a key that did leak: cancel it first, then clean up
  • A one-command sweep of every repo on your GitHub account
Before you start
  • A project that uses Git (anything you've pushed to GitHub counts)
  • Git installed. If git --version prints a number, you're set
  • About 31MB of free disk space
  • For the clean-up in step 6 only: uv (winget install --id astral-sh.uv -e on Windows, brew install uv on a Mac, or see Level 0)
01/06Get Gitleaks (one file, no admin)0 done
STEP 01 of 06~5 min

Get Gitleaks (one file, no admin)

Gitleaks is a single free program. No account, no installer, and it runs on your own computer.

  1. Gitleaks ↗ is a free, open-source scanner with about 29,800 stars on GitHub. It knows 222 patterns for API keys, tokens and passwords, from OpenAI and Stripe keys to AWS and GitHub tokens.

  2. Open PowerShell and paste this. It downloads the official Windows build from Gitleaks' GitHub releases into a gitleaks folder in your user folder:

    Windows (PowerShell)
    $dir = "$HOME\gitleaks"
Invoke-WebRequest https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_windows_x64.zip -OutFile "$dir.zip"
Expand-Archive "$dir.zip" $dir
Set-Alias gitleaks "$dir\gitleaks.exe"
gitleaks version
    Output
    8.30.1

  3. The download is 8.4MB. Unzipped, it's one 22.6MB file, gitleaks.exe. Nothing is installed into Windows and there's no admin prompt.

    TipSet-Alias only lasts until you close the window. In a new PowerShell window, run Set-Alias gitleaks "$HOME\gitleaks\gitleaks.exe" first. Want a permanent command instead? winget install --id Gitleaks.Gitleaks -e installs the same official build as a normal command.
    Mac
    brew install gitleaks
✓
Checkpointgitleaks version prints 8.30.1 (or a newer number).
If it breaksExpand-Archive says a file "already exists" + 1 more
Expand-Archive says a file "already exists"
You've run it before. Add -Force to the end of the Expand-Archive line and run it again.
'gitleaks' is not recognized
You're in a new PowerShell window, so the shortcut has gone. Run the Set-Alias line again.
Still stuck? Ask the community
Next mission · Go darkYour old gamer tag is still out there: find every account and clean it up
→