Skip to main content
The Infisical CLI includes a secret scanner, infisical scan, that finds leaked secrets in a Git repository’s history, in a directory, or in changes you haven’t committed yet.

​
Prerequisites

  • The Infisical CLI installed
  • Git installed, if you’re scanning a Git repository

​
Scan a Git repository

To scan the full history of the Git repository you’re in, run:
The scan reads every commit on every branch. To scan a range of commits instead, pass Git log options with --log-opts, such as --log-opts="--all commitA..commitB".

​
Scan a directory without Git history

To scan the current files in a directory or a file without reading Git history, add --no-git and point --source at the directory or file:

​
Exit codes and reports

If the scan finds a secret, the command exits with code 1, which fails a CI job. To write the findings to a file, add --report-path, and pick a format with --report-format: json (the default), csv, sarif, or junit.

​
Next steps

Pre-commit hook

Prevent secrets from getting committed with a pre-commit hook that runs infisical scan.

Ignore findings

Stop infisical scan from reporting secrets you’ve decided are safe to commit.

Configuration

Add your own detection rules to infisical scan and skip secrets you’ve decided are safe.

infisical scan

See every flag of the scan commands.