gitleaks / gitleaks/gitleaks

GitLeaks overreach flagging variable called "privateKey"

Open
#2,182 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
29.3k
Forks
2.2k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
It flags the following Swift code (using CryptoKit types) as a private key leak. This is just a variable declaration, there is no private key being leaked at all.

```swift
let privateKey: P256.Signing.PrivateKey
```

**To Reproduce**
Steps to reproduce the behavior:

Create a Swift project that has the following in a source file:

```swift
import CryptoKit

func testFunction() {
let privateKey: P256.Signing.PrivateKey
privateKey = try! P256.Signing.PrivateKey(rawRepresentation: Data())
}
```

**Expected behavior**
Simply declaring a variable called `privateKey` should not be flagged.

**Screenshots**

Log dump showing the failure at 2026-06-25T19:29:41.7787043Z:
```
2026-06-25T19:29:40.6075205Z gitleaks version: 8.24.3
2026-06-25T19:29:40.6080998Z Version to install: 8.24.3 (target directory: /tmp/gitleaks-8.24.3)
2026-06-25T19:29:40.7138349Z Cache hit for: gitleaks-cache-8.24.3-linux-x64
2026-06-25T19:29:40.9238213Z Received 5717457 of 5717457 (100.0%), 36.8 MBs/sec
2026-06-25T19:29:40.9240053Z Cache Size: ~5 MB (5717457 B)
2026-06-25T19:29:40.9274872Z [command]/usr/bin/tar -xf /home/runner/work/_temp/7e348bc8-1223-498f-96b9-7b03be551103/cache.tzst -P -C /home/runner/work/ios/ios --use-compress-program unzstd
2026-06-25T19:29:40.9722183Z Cache restored successfully
2026-06-25T19:29:40.9727922Z Gitleaks restored from cache
2026-06-25T19:29:40.9731534Z event type: pull_request
2026-06-25T19:29:41.2110945Z gitleaks cmd: gitleaks detect --redact -v --exit-code=2 --report-format=sarif --report-path=results.sarif --log-level=debug --log-opts=--no-merges --first-parent 78bfa86370893a906e2379d1485b68ddc786dd8f^..032461dc7e328c2fa307d6a69f629d8636084448
2026-06-25T19:29:41.2130738Z [command]/tmp/gitleaks-8.24.3/gitleaks detect --redact -v --exit-code=2 --report-format=sarif --report-path=results.sarif --log-level=debug --log-opts=--no-merges --first-parent 78bfa86370893a906e2379d1485b68ddc786dd8f^..032461dc7e328c2fa307d6a69f629d8636084448
2026-06-25T19:29:41.5539559Z
2026-06-25T19:29:41.5573999Z ○
2026-06-25T19:29:41.5593660Z │╲
2026-06-25T19:29:41.5594336Z │ ○
2026-06-25T19:29:41.5594750Z ○ ░
2026-06-25T19:29:41.5595167Z ░ gitleaks
2026-06-25T19:29:41.5595430Z
2026-06-25T19:29:41.5596003Z 7:29PM DBG using github.com/wasilibs/go-re2 regex engine
2026-06-25T19:29:41.5597250Z 7:29PM DBG using existing gitleaks config .gitleaks.toml from `(--source)/.gitleaks.toml`
2026-06-25T19:29:41.7392240Z 7:29PM DBG extending config with default config
2026-06-25T19:29:41.7412087Z 7:29PM DBG executing: /usr/bin/git -C . log -p -U0 --no-merges --first-parent 78bfa86370893a906e2379d1485b68ddc786dd8f^..032461dc7e328c2fa307d6a69f629d8636084448
2026-06-25T19:29:41.7487409Z 7:29PM DBG SCM platform parsed from host host=github.com platform=github
2026-06-25T19:29:41.7787043Z Finding: let privateKey: REDACTED
2026-06-25T19:29:41.7803907Z Secret: REDACTED
2026-06-25T19:29:41.7821548Z RuleID: generic-api-key
2026-06-25T19:29:41.7822573Z Entropy: 3.882045
```

**Basic Info (please complete the following information):**
- OS: Linux
- Gitleaks Version: 8.24.3

**Additional context**
Add any other context about the problem here.

cc @zricethezav

Contributor guide

Open the contributing guide

Research direction

Reproduce the false positive with the Swift and CryptoKit snippet using the `gitleaks detect` entry point, then inspect the `generic-api-key` rule and the repository’s `.gitleaks.toml` configuration. Done means the declaration is no longer reported while genuine API keys remain detectable; add or update coverage for this example if the relevant test location is found.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, swift
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.