Full Report
A new open-source tool called Betterleaks can scan directories, files, and git repositories and identify valid secrets using default or customized rules. [...]
Analysis Summary
# Tool/Technique: Betterleaks
## Overview
Betterleaks is a high-performance, open-source secrets scanning tool designed to identify sensitive information such as API keys, credentials, private keys, and tokens within directories, files, and Git repositories. Developed as the successor to Gitleaks, it aims to reduce false positives and increase scanning speed through advanced tokenization and rule-defined validation.
## Technical Details
- **Type:** Attack Surface Management / Defensive Tool (Dual-use)
- **Platform:** OS Independent (Pure Go implementation)
- **Capabilities:** High-speed secrets discovery, encoded secret decoding, parallelized repository analysis.
- **First Seen:** March 15, 2026 (Public announcement)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1552 - Unsecured Credentials]
- [T1552.001 - Private Keys]
- [T1552.003 - Bash History]
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery]
- [T1555 - Credentials from Password Stores]
- **[TA0006 - Credential Access]**
- [T1212 - Exploitation for Credential Access]
## Functionality
### Core Capabilities
- **BPE Tokenization:** Utilizes Byte Pair Encoding (BPE) for "Token Efficiency Scanning," achieving a 98.6% recall rate, significantly outperforming traditional entropy-based detection.
- **Parallelized Git Scanning:** Optimized for high-speed analysis of large-scale repositories through concurrent processing.
- **Multi-Source Scanning:** Scans local directories, individual files, and entire Git version histories.
- **CEL Validation:** Uses Common Expression Language (CEL) for sophisticated, rule-defined validation of discovered secrets.
- **Deep Encoding Support:** Automatically handles and decodes doubly or triply encoded secrets that might bypass simpler scanners.
### Advanced Features
- **No External Dependencies:** Built in pure Go (no CGO or Hyperscan), ensuring easy portability and deployment.
- **AI-Agent Optimization:** Includes CLI features specifically designed for ingestion by AI workflows and automated code analysis tools.
- **Upcoming Roadmap:** Planned features include LLM-assisted classification, automatic secret revocation via APIs, and permissions mapping.
## Indicators of Compromise
*Note: As a legitimate open-source security tool, "IOCs" in this context refer to the presence of the tool in an environment where it may be used by a threat actor for reconnaissance.*
- **File Names:** `betterleaks`, `betterleaks.exe`
- **Behavioral Indicators:**
- High-volume read operations across `.git` directories and configuration files (`.env`, `config.yml`, `settings.json`).
- Network connections to GitHub, GitLab, or Bitbucket APIs if cloud scanning is enabled.
## Associated Threat Actors
- **Red Teams / Security Researchers:** Primary demographic for defensive auditing.
- **Opportunistic Threat Actors:** Likely to adopt the tool for automated "secrets hunting" on public repositories (e.g., GitHub/S3 buckets) to gain initial access credentials.
## Detection Methods
- **Behavioral Detection:** Monitor for unauthorized processes executing broad file-system walks, specifically targeting sensitive extensions or Git metadata.
- **EDR/Command Line Logging:** Monitor for execution of CLI tools with arguments targeting repositories or sensitive directories (e.g., `betterleaks scan .`).
- **Audit Logs:** Monitor Git provider logs for rapid, automated cloning or "raking" of repositories by a single user/token.
## Mitigation Strategies
- **Pre-commit Hooks:** Implement Betterleaks or similar tools in the local development workflow to prevent secrets from being committed to the codebase.
- **Secret Management:** Utilize dedicated secret vaults (e.g., HashiCorp Vault, AWS Secrets Manager) instead of hardcoding credentials in configuration files.
- **Credential Rotation:** Regularly rotate API keys and tokens to minimize the window of opportunity if a secret is leaked.
- **Repository Scanning:** Run continuous CI/CD pipeline scans to catch leaked secrets before they reach production.
## Related Tools/Techniques
- **Gitleaks:** The predecessor to Betterleaks.
- **TruffleHog:** A widely used secrets scanner focusing on high-entropy strings and verified secrets.
- **Git-defender / SecretScanner:** Similar utilities for repository auditing.