Betterleaks Zachary Rice

Betterleaks is a configurable and efficient secrets scanner designed to detect sensitive information such as passwords, API keys, and other confidential data across various sources. Built as an evolution of Gitleaks, it offers advanced capabilities for detecting and validating secrets in code repositories, cloud storage, and more.

Key Features:

• CEL-Based Filtering: Write expressive filters using Common Expression Language (CEL) to reduce false positives by evaluating attributes like file paths, git author details, or finding data.
• Secrets Validation: Perform asynchronous HTTP requests directly from rule definitions to validate detected secrets, ensuring accuracy and reducing noise.
• Token Efficiency Filtering: Use BPE tokenization to filter out natural language false positives by measuring how "rare" a string appears.
• Fast Scans: Achieve high performance through parallelization, ahocorasick keyword filtering, and the re2 regex engine.
• Source Support: Scan GitHub, GitLab, Hugging Face, S3, and other sources with ease, supporting both public and private resources.
• Portability: Runs on any modern OS/architecture as a lightweight binary, making it easy to integrate into CI/CD pipelines or existing workflows.

Audience & Benefit: Ideal for developers, DevSecOps teams, and security professionals who need robust secret detection in their projects. By identifying sensitive data early, Betterleaks helps improve code quality, reduce security risks, and maintain compliance with minimal false positives. It integrates seamlessly into existing development processes, enabling organizations to fortify their CI/CD pipelines against accidental secret exposure.

The tool can be installed via winget for easy setup on Windows systems.