How Gitleaks’s scores are calculated

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

• [probe] https://gitleaks.io/llms.txt“PROBE llms.txt: HTTP 404 at https://gitleaks.io/llms.txt”
• [probe] https://gitleaks.io/openapi.json“PROBE openapi: all candidate paths 404 (https://gitleaks.io/openapi.json, https://gitleaks.io/swagger.json, https://gitleaks.io/api/openapi.json, https://gitleaks.io/.well-known/openapi.json)”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

• [github] https://github.com/gitleaks/gitleaks“The `git` command lets you scan local git repos.”
• [github] https://github.com/gitleaks/gitleaks“The `dir` (aliases include `files`, `directory`) command lets you scan directories and files.”
• [github] https://github.com/gitleaks/gitleaks“You can also stream data to gitleaks with the `stdin` command.”
• [github] https://github.com/gitleaks/gitleaks“Gitleaks can be installed using Homebrew, Docker, or Go.”
• [claimed-docs] https://github.com/gitleaks/gitleaks-action“Enable **Gitleaks-Action** in your GitHub workflows to be alerted when secrets are leaked as soon as they happen.”
• [claimed-docs] https://gitleaks.io“You can use it to automatically run a gitleaks scan on all your team's pull requests and commits, or run on-demand scans.”
• [github] https://github.com/gitleaks/gitleaks“➜ git commit -m "this commit contains a secret" Detect hardcoded secrets.................................................Failed”

Plug MCP servers into this product so it can use their toolsweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Connect an agent via an official MCP serverweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Use an official CLIweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

• [github] https://github.com/gitleaks/gitleaks“The `git` command lets you scan local git repos.”
• [github] https://github.com/gitleaks/gitleaks“The `dir` (aliases include `files`, `directory`) command lets you scan directories and files.”
• [github] https://github.com/gitleaks/gitleaks“You can also stream data to gitleaks with the `stdin` command.”
• [github] https://github.com/gitleaks/gitleaks“Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, and whatever else you wanna throw at it via stdin.”
• [probe] https://github.com/gitleaks/gitleaks“official CLI documented at https://github.com/gitleaks/gitleaks”

Drive the product through a documented public APIweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

• [probe] https://gitleaks.io/llms.txt“PROBE llms.txt: HTTP 404 at https://gitleaks.io/llms.txt”
• [probe] https://gitleaks.io/openapi.json“PROBE openapi: all candidate paths 404 (https://gitleaks.io/openapi.json, https://gitleaks.io/swagger.json, https://gitleaks.io/api/openapi.json, https://gitleaks.io/.well-known/openapi.json)”
• [probe] https://github.com/gitleaks/gitleaks“official CLI documented at https://github.com/gitleaks/gitleaks”

Issue scoped/least-privilege API credentials for an agentweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Build against official SDKsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Subscribe to events via webhooksweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

• [probe] https://gitleaks.io/llms.txt“PROBE llms.txt: HTTP 404 at https://gitleaks.io/llms.txt”
• [probe] https://gitleaks.io/openapi.json“PROBE openapi: all candidate paths 404 (https://gitleaks.io/openapi.json, https://gitleaks.io/swagger.json, https://gitleaks.io/api/openapi.json, https://gitleaks.io/.well-known/openapi.json)”
• [claimed-docs] https://github.com/gitleaks/gitleaks-action“Enable **Gitleaks-Action** in your GitHub workflows to be alerted when secrets are leaked as soon as they happen.”
• [claimed-docs] https://github.com/gitleaks/gitleaks-action“A list of GitHub accounts that should be alerted when **gitleaks-action** detects a leak.”

Explore an interactive API reference with runnable examplesweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

• [probe] https://gitleaks.io/llms.txt“PROBE llms.txt: HTTP 404 at https://gitleaks.io/llms.txt”
• [probe] https://gitleaks.io/openapi.json“PROBE openapi: all candidate paths 404 (https://gitleaks.io/openapi.json, https://gitleaks.io/swagger.json, https://gitleaks.io/api/openapi.json, https://gitleaks.io/.well-known/openapi.json)”

Download a machine-readable API spec (OpenAPI or equivalent)weight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

• [probe] https://gitleaks.io/llms.txt“PROBE llms.txt: HTTP 404 at https://gitleaks.io/llms.txt”
• [probe] https://gitleaks.io/openapi.json“PROBE openapi: all candidate paths 404 (https://gitleaks.io/openapi.json, https://gitleaks.io/swagger.json, https://gitleaks.io/api/openapi.json, https://gitleaks.io/.well-known/openapi.json)”

Test against a sandbox environment without touching production dataweight 1

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Rely on versioned APIs with a documented deprecation policyweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

• [probe] https://gitleaks.io/llms.txt“PROBE llms.txt: HTTP 404 at https://gitleaks.io/llms.txt”
• [probe] https://gitleaks.io/openapi.json“PROBE openapi: all candidate paths 404 (https://gitleaks.io/openapi.json, https://gitleaks.io/swagger.json, https://gitleaks.io/api/openapi.json, https://gitleaks.io/.well-known/openapi.json)”

Do everything through the API that I can do in the UIweight 2

n/a — not applicable to this product: excluded from numerator and denominator

• [probe] https://gitleaks.io/llms.txt“PROBE llms.txt: HTTP 404 at https://gitleaks.io/llms.txt”
• [probe] https://gitleaks.io/openapi.json“PROBE openapi: all candidate paths 404 (https://gitleaks.io/openapi.json, https://gitleaks.io/swagger.json, https://gitleaks.io/api/openapi.json, https://gitleaks.io/.well-known/openapi.json)”
• [probe] https://github.com/gitleaks/gitleaks“official CLI documented at https://github.com/gitleaks/gitleaks”

Export all of my data in open formats and leaveweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Read the product's source under an open licenseweight 2

2 (weight) × 7 (quality) × 1.0 (full) = 14.0 of 20 max

• [github] https://github.com/gitleaks/gitleaks“The `git` command lets you scan local git repos.”
• [probe] https://github.com/gitleaks/gitleaks“official CLI documented at https://github.com/gitleaks/gitleaks”
• [github] https://github.com/gitleaks/gitleaks“Gitleaks can be installed using Homebrew, Docker, or Go.”

Self-host the core productweight 3

3 (weight) × 8 (quality) × 1.0 (full) = 24.0 of 30 max

• [github] https://github.com/gitleaks/gitleaks“Gitleaks can be installed using Homebrew, Docker, or Go.”
• [github] https://github.com/gitleaks/gitleaks“The `git` command lets you scan local git repos.”
• [github] https://github.com/gitleaks/gitleaks“The `dir` (aliases include `files`, `directory`) command lets you scan directories and files.”
• [github] https://github.com/gitleaks/gitleaks“You can also stream data to gitleaks with the `stdin` command.”
• [github] https://github.com/gitleaks/gitleaks“Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, and whatever else you wanna throw at it via stdin.”

Get AI-generated insights and suggestions from my data inside the productweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

• [probe] https://gitleaks.io/llms.txt“PROBE llms.txt: HTTP 404 at https://gitleaks.io/llms.txt”
• [probe] https://gitleaks.io/openapi.json“PROBE openapi: all candidate paths 404 (https://gitleaks.io/openapi.json, https://gitleaks.io/swagger.json, https://gitleaks.io/api/openapi.json, https://gitleaks.io/.well-known/openapi.json)”
• [github] https://github.com/gitleaks/gitleaks“Gitleaks offers a configuration format you can follow to write your own secret detection rules”
• [github] https://github.com/gitleaks/gitleaks“Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, and whatever else you wanna throw at it via stdin.”

Set up automations that run autonomously in the backgroundweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

• [claimed-docs] https://github.com/gitleaks/gitleaks-action“Enable **Gitleaks-Action** in your GitHub workflows to be alerted when secrets are leaked as soon as they happen.”
• [claimed-docs] https://gitleaks.io“You can use it to automatically run a gitleaks scan on all your team's pull requests and commits, or run on-demand scans.”
• [github] https://github.com/gitleaks/gitleaks“You can run Gitleaks as a pre-commit hook by copying the example `pre-commit.py` script into your `.git/hooks/` directory.”
• [claimed-docs] https://github.com/gitleaks/gitleaks-action“There are no changes to inputs, outputs, or behavior. The upgrade is a one-line change in your workflow file”

Delegate tasks to a built-in AI assistant inside the productweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Operate the product with natural-language commandsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Perform bulk operations across many items at onceweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

• [github] https://github.com/gitleaks/gitleaks“The `git` command lets you scan local git repos.”
• [github] https://github.com/gitleaks/gitleaks“The `git` command lets you scan local git repos. Under the hood, gitleaks uses the `git log -p` command to scan patches.”
• [github] https://github.com/gitleaks/gitleaks“The `dir` (aliases include `files`, `directory`) command lets you scan directories and files.”
• [github] https://github.com/gitleaks/gitleaks“The `dir` (aliases include `files`, `directory`) command lets you scan directories and files. Example: `gitleaks dir -v path_to_directory_or_file`.”
• [claimed-docs] https://gitleaks.io“You can use it to automatically run a gitleaks scan on all your team's pull requests and commits, or run on-demand scans.”
• [claimed-docs] https://github.com/gitleaks/gitleaks-action“Enable **Gitleaks-Action** in your GitHub workflows to be alerted when secrets are leaked as soon as they happen.”

Define rules that trigger actions automatically on eventsweight 3

3 (weight) × 5 (quality) × 0.6 (partial) = 9.0 of 30 max

• [github] https://github.com/gitleaks/gitleaks“You can run Gitleaks as a pre-commit hook by copying the example `pre-commit.py` script into your `.git/hooks/` directory.”
• [github] https://github.com/gitleaks/gitleaks“Gitleaks offers a configuration format you can follow to write your own secret detection rules”
• [claimed-docs] https://github.com/gitleaks/gitleaks-action“Enable **Gitleaks-Action** in your GitHub workflows to be alerted when secrets are leaked as soon as they happen.”
• [claimed-docs] https://github.com/gitleaks/gitleaks-action“A list of GitHub accounts that should be alerted when **gitleaks-action** detects a leak.”
• [claimed-docs] https://github.com/gitleaks/gitleaks-action“**gitleaks-action** uses this token to call [a GitHub API] to comment on PRs.”
• [github] https://github.com/gitleaks/gitleaks“➜ git commit -m "this commit contains a secret" Detect hardcoded secrets.................................................Failed”

Schedule recurring jobs or workflowsweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Version, review, and roll back my automationsweight 1

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh