ContextQMD
Back to Infisical

scan git-changes

docs/cli/commands/scan-git-changes.mdx

0.159.252.3 KB
Original Source
bash
infisical scan git-changes

# Display the full secret findings
infisical scan git-changes --verbose

Description

Scanning for secrets before you commit your changes is great way to prevent leaks. Infisical makes this easy with the sub command git-changes.

The git-changes scans for uncommitted changes in a Git repository, and is especially designed for use on developer machines, aligning with the 'shift left' security approach. When git-changes is run on a Git repository, Infisical parses the output from a git diff command.

To scan changes in commits that have been staged via git add, you can add the --staged flag to the sub command. This flag is particularly useful when using Infisical CLI as a pre-commit tool.

Flags

<Accordion title="--staged"> **Description**

detect secrets in a --staged state

Default value: false </Accordion>

<Accordion title="--log-opts"> **Description**

git log options </Accordion>

<Accordion title="--baseline-path"> Short hand: `-b`

Description

path to baseline with issues that can be ignored </Accordion>

<Accordion title="--config"> Short hand: `-c`

Description

config file path

order of precedence:

  1. --config flag
  2. env var INFISICAL_SCAN_CONFIG
  3. (--source/-s)/.infisical-scan.toml If none of the three options are used, then Infisical will use the default config </Accordion>
<Accordion title="--exit-code"> **Description**

exit code when leaks have been encountered (default 1) </Accordion>

<Accordion title="--max-target-megabytes"> **Description**

files larger than this will be skipped </Accordion>

<Accordion title="--no-color"> **Description**

turn off color for verbose output </Accordion>

<Accordion title="--redact"> **Description**

redact secrets from logs and stdout </Accordion>

<Accordion title="--report-format"> **Description**

output format (json, csv, sarif) (default "json") </Accordion>

<Accordion title="--report-path"> **Description**

report file </Accordion>

<Accordion title="--source"> **Description**

path to source (default ".") </Accordion>

<Accordion title="--verbose"> **Description**

show verbose output from scan </Accordion>