> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Betterleaks

> CodeRabbit runs Betterleaks to detect secrets in changed files.

[Betterleaks](https://github.com/betterleaks/betterleaks) is a secret scanner built on [Gitleaks](https://gitleaks.io/) that provides enhanced secret detection. CodeRabbit runs Betterleaks version 1.8.1.

## Files

Betterleaks runs on changed files in the pull request, regardless of file type.

## Configuration

Betterleaks is enabled by default and is configured using the `gitleaks` key in your `.coderabbit.yaml` file. The key name is preserved for backward compatibility; existing configurations continue to work without any changes.

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        gitleaks:
          enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews → Tools → Betterleaks** in your organization or repository settings and toggle Betterleaks `on` or `off`.
  </Tab>
</Tabs>

CodeRabbit runs Betterleaks with its bundled defaults and does not pass a repository configuration file to the scan.

## Security policy and restrictions

CodeRabbit scans one escaped local file path at a time with updates disabled. Betterleaks does not scan Git history or execute repository code or plugins.

## When we skip Betterleaks

CodeRabbit will skip running Betterleaks when:

* Gitleaks is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

## Notes

* Betterleaks runs on the changed files in the pull request (not just specific file types).
* Betterleaks uses the `--no-git` flag, so it scans files directly rather than scanning Git history.
* The configuration key in `.coderabbit.yaml` remains `gitleaks` for backward compatibility. No changes to your existing configuration are required.

## What's next

<CardGroup cols={1}>
  <Card title="Trivy" href="/tools/trivy" icon="shield-check" horizontal>
    Scan container images and filesystems for known vulnerabilities, misconfigurations, and exposed secrets.
  </Card>

  <Card title="OSV-Scanner" href="/tools/osv-scanner" icon="shield-alert" horizontal>
    Identify known vulnerabilities in your project's dependencies using Google's OSV.dev database.
  </Card>

  <Card title="Linters & security analysis tools" href="/tools" icon="wrench" horizontal>
    Explore all 50+ tools CodeRabbit integrates with for code quality and security analysis.
  </Card>
</CardGroup>