Skip to main content
Betterleaks is a secret scanner built on Gitleaks that provides enhanced secret detection. CodeRabbit runs Betterleaks version 1.8.1.

​
Files

Betterleaks runs on changed files in the pull request, regardless of file type.

​
Configuration

Betterleaks is enabled by default and is configured using the gitleaks key in your .coderabbit.yaml file. The key name is preserved for backward compatibility; existing configurations continue to work without any changes.
.coderabbit.yaml
CodeRabbit runs Betterleaks with its bundled defaults and does not pass a repository configuration file to the scan.

​
Security policy and restrictions

CodeRabbit scans one escaped local file path at a time with updates disabled. Betterleaks does not scan Git history or execute repository code or plugins.

​
When we skip Betterleaks

CodeRabbit will skip running Betterleaks when:
  • Gitleaks is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

​
Notes

  • Betterleaks runs on the changed files in the pull request (not just specific file types).
  • Betterleaks uses the --no-git flag, so it scans files directly rather than scanning Git history.
  • The configuration key in .coderabbit.yaml remains gitleaks for backward compatibility. No changes to your existing configuration are required.

​
What’s next

Trivy

Scan container images and filesystems for known vulnerabilities, misconfigurations, and exposed secrets.

OSV-Scanner

Identify known vulnerabilities in your project’s dependencies using Google’s OSV.dev database.

Linters & security analysis tools

Explore all 50+ tools CodeRabbit integrates with for code quality and security analysis.