Gitleaks Integration with DefectDojo
Gitleaks is an open-source static analysis security tool that scans Git repositories, files, and directories to detect hardcoded secrets including passwords, API keys, tokens, private keys, and credentials by analyzing source code and entire Git commit history using regex patterns and Shannon entropy analysis. The tool integrates into developer workflows through pre-commit hooks, CI/CD pipelines, and GitHub Actions to prevent sensitive information from being committed to version control systems, providing customizable rules, baseline mechanisms for managing known secrets, and multiple output formats including JSON, SARIF, and CSV for automated security reporting.
Data Granularity: What Gets Imported
The following fields are captured from Gitleaks results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Gitleaks",
"engagement": "<engagement-id>",
"file": "results.json"
}