Betterleaks: The Gitleaks Successor Built for Agentic Secrets Scanning

The original creator of Gitleaks — a secrets scanner with 26 million GitHub downloads and 1.2 million Homebrew installations — has rebuilt the tool from scratch. The result is Betterleaks: a drop-in CLI replacement designed for a scanning landscape that now includes AI coding agents as a primary threat surface.

Zach Rice, now Head of Secrets Scanning at Aikido Security, developed Betterleaks after losing governance control over the original Gitleaks project. Rather than contribute upstream under a governance structure he didn’t control, he started fresh — bringing three long-time Gitleaks contributors from RBC, Red Hat, and Amazon as co-maintainers, with Aikido sponsoring development while the project remains independent under MIT license.

Context

Secrets scanners sit at the intersection of two expanding threat surfaces: repositories still contain hardcoded API keys and credentials at rates that have not meaningfully improved over a decade of tooling, and AI coding environments — Claude Code, Codex, Cursor — now generate code with the same propensity to embed secrets as human-written code, at higher velocity.

Gitleaks addressed the first problem well. Betterleaks addresses both, with explicit CLI design decisions oriented toward how AI agents invoke tools: tight flag controls, predictable output formats, and reduced token overhead for agent consumption.

The Detail

The technical departure from Gitleaks centers on detection methodology. Traditional secrets scanners rely on entropy filtering — high-entropy strings are flagged as likely secrets. Betterleaks replaces this with Token Efficiency, a technique based on byte pair encoding (BPE) tokenization. The approach measures how efficiently a tokenizer compresses a string: secrets compress differently than natural language. Against the CredData benchmark dataset, Token Efficiency achieves 98.6% recall compared to 70.4% for entropy-based filtering — a 28-point improvement that means fewer misses in production, not just better benchmark numbers.

Validation logic is the second architectural change. Where Gitleaks embeds validation in compiled Go code, Betterleaks implements Rule Defined Validation using the Common Expression Language (CEL) — meaning validation rules are configurable at the rule level without recompiling the tool. Security teams can tune detection behavior for their specific secret types and environments without forking the project.

The implementation is pure Go without CGO dependencies, which matters for environments where build reproducibility is a compliance requirement. Default encoding detection handles multiply-encoded secrets — a category that catches organizations whose credentials pass through base64 encoding before storage. Parallelized git scanning improves repository scan throughput.

For teams currently running Gitleaks, the migration path is designed to be low-friction: existing configurations and CLI flags carry over without modification.

Source: The New Stack

Content created with AI assistance and reviewed for accuracy.