GitLeaks overreach flagging variable called "privateKey"
- Dominant language
- Go
- Stars
- 29.3k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
It flags the following Swift code (using CryptoKit types) as a private key leak. This is just a variable declaration, there is no private key being leaked at all.
```swift
let privateKey: P256.Signing.PrivateKey
```
**To Reproduce**
Steps to reproduce the behavior:
Create a Swift project that has the following in a source file:
```swift
import CryptoKit
func testFunction() {
let privateKey: P256.Signing.PrivateKey
privateKey = try! P256.Signing.PrivateKey(rawRepresentation: Data())
}
```
**Expected behavior**
Simply declaring a variable called `privateKey` should not be flagged.
**Screenshots**
Log dump showing the failure at 2026-06-25T19:29:41.7787043Z:
```
2026-06-25T19:29:40.6075205Z gitleaks version: 8.24.3
2026-06-25T19:29:40.6080998Z Version to install: 8.24.3 (target directory: /tmp/gitleaks-8.24.3)
2026-06-25T19:29:40.7138349Z Cache hit for: gitleaks-cache-8.24.3-linux-x64
2026-06-25T19:29:40.9238213Z Received 5717457 of 5717457 (100.0%), 36.8 MBs/sec
2026-06-25T19:29:40.9240053Z Cache Size: ~5 MB (5717457 B)
2026-06-25T19:29:40.9274872Z [command]/usr/bin/tar -xf /home/runner/work/_temp/7e348bc8-1223-498f-96b9-7b03be551103/cache.tzst -P -C /home/runner/work/ios/ios --use-compress-program unzstd
2026-06-25T19:29:40.9722183Z Cache restored successfully
2026-06-25T19:29:40.9727922Z Gitleaks restored from cache
2026-06-25T19:29:40.9731534Z event type: pull_request
2026-06-25T19:29:41.2110945Z gitleaks cmd: gitleaks detect --redact -v --exit-code=2 --report-format=sarif --report-path=results.sarif --log-level=debug --log-opts=--no-merges --first-parent 78bfa86370893a906e2379d1485b68ddc786dd8f^..032461dc7e328c2fa307d6a69f629d8636084448
2026-06-25T19:29:41.2130738Z [command]/tmp/gitleaks-8.24.3/gitleaks detect --redact -v --exit-code=2 --report-format=sarif --report-path=results.sarif --log-level=debug --log-opts=--no-merges --first-parent 78bfa86370893a906e2379d1485b68ddc786dd8f^..032461dc7e328c2fa307d6a69f629d8636084448
2026-06-25T19:29:41.5539559Z
2026-06-25T19:29:41.5573999Z ○
2026-06-25T19:29:41.5593660Z │╲
2026-06-25T19:29:41.5594336Z │ ○
2026-06-25T19:29:41.5594750Z ○ ░
2026-06-25T19:29:41.5595167Z ░ gitleaks
2026-06-25T19:29:41.5595430Z
2026-06-25T19:29:41.5596003Z [90m7:29PM[0m DBG using github.com/wasilibs/go-re2 regex engine
2026-06-25T19:29:41.5597250Z [90m7:29PM[0m DBG using existing gitleaks config .gitleaks.toml from `(--source)/.gitleaks.toml`
2026-06-25T19:29:41.7392240Z [90m7:29PM[0m DBG extending config with default config
2026-06-25T19:29:41.7412087Z [90m7:29PM[0m DBG executing: /usr/bin/git -C . log -p -U0 --no-merges --first-parent 78bfa86370893a906e2379d1485b68ddc786dd8f^..032461dc7e328c2fa307d6a69f629d8636084448
2026-06-25T19:29:41.7487409Z [90m7:29PM[0m DBG SCM platform parsed from host [36mhost=[0mgithub.com [36mplatform=[0mgithub
2026-06-25T19:29:41.7787043Z Finding: let privateKey: [1;3;mREDACTED[0m
2026-06-25T19:29:41.7803907Z Secret: [1;3;mREDACTED[0m
2026-06-25T19:29:41.7821548Z RuleID: generic-api-key
2026-06-25T19:29:41.7822573Z Entropy: 3.882045
```
**Basic Info (please complete the following information):**
- OS: Linux
- Gitleaks Version: 8.24.3
**Additional context**
Add any other context about the problem here.
cc @zricethezav
Contributor guide
Research direction
Reproduce the false positive with the Swift and CryptoKit snippet using the `gitleaks detect` entry point, then inspect the `generic-api-key` rule and the repository’s `.gitleaks.toml` configuration. Done means the declaration is no longer reported while genuine API keys remain detectable; add or update coverage for this example if the relevant test location is found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, swift
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100