Skip to main content
infisical scan git-changes

# Display the full secret findings
infisical scan git-changes --verbose

​
Description

Scanning for secrets before you commit your changes is great way to prevent leaks. Infisical makes this easy with the sub command git-changes. The git-changes scans for uncommitted changes in a Git repository, and is especially designed for use on developer machines, aligning with the ‘shift left’ security approach. When git-changes is run on a Git repository, Infisical parses the output from a git diff command. To scan changes in commits that have been staged via git add, you can add the --staged flag to the sub command. This flag is particularly useful when using Infisical CLI as a pre-commit tool.

​
Flags

Descriptiondetect secrets in a —staged stateDefault value: false
Descriptiongit log options
Short hand: -bDescriptionpath to baseline with issues that can be ignored
Short hand: -cDescriptionconfig file pathorder of precedence:
  1. —config flag
  2. env var INFISICAL_SCAN_CONFIG
  3. (—source/-s)/.infisical-scan.toml If none of the three options are used, then Infisical will use the default config
Descriptionexit code when leaks have been encountered (default 1)
Descriptionfiles larger than this will be skipped
Descriptionturn off color for verbose output
Descriptionredact secrets from logs and stdout
Descriptionoutput format (json, csv, sarif) (default “json”)
Descriptionreport file
Descriptionpath to source (default ”.”)
Descriptionshow verbose output from scan