Betterleaks Integration Guide

Integrate Betterleaks with Vulnetix. Scan git repositories, files, and stdin for leaked secrets using regex patterns combined with entropy analysis. Export findings as SARIF.

Install & scan

$ # Homebrew (macOS/Linux)
brew install betterleaks

# Binary download from releases
curl -L https://github.com/betterleaks/betterleaks/releases/latest/download/betterleaks_Linux_x86_64.tar.gz | tar xz
sudo mv betterleaks /usr/local/bin/
$ # Scan git repository with SARIF output
betterleaks git   -f sarif   -r betterleaks.sarif   .

Run Betterleaks in CI

Scan on every push and upload the report as a workflow artifact:

- name: Betterleaks secret scan
  run: |
    curl -L https://github.com/betterleaks/betterleaks/releases/latest/download/betterleaks_Linux_x86_64.tar.gz | tar xz
    sudo mv betterleaks /usr/local/bin/
    betterleaks git -f sarif -r betterleaks.sarif .

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: betterleaks
    path: betterleaks.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Betterleaks's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Betterleaks. Keep running it. Vulnetix sits on top of Betterleaks (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

✓ full · ~ partial · ✗ not covered

What Betterleaks does well

• Higher recall than Gitleaks via a BPE-tokenization (cl100k_base) efficiency filter instead of Shannon entropy, reported 98.6% recall on CredData vs 70.4% for entropy
• Live token validation: CEL-based rules fire HTTP requests against detected credentials to confirm whether they are still active, cutting noise from dead secrets
• Recursive decoding of doubly/triply-encoded secrets (base64, hex, percent, unicode) plus archive scanning (zip, tar); pure Go with no CGO/Hyperscan dependency
• Drop-in Gitleaks successor by the same author (Zach Rice): backwards-compatible TOML config and CLI flags, with parallelised git scanning for speed

Where Vulnetix adds to it: Betterleaks is a best-in-class dedicated secret scanner; Vulnetix does not replace it. Vulnetix ingests and consolidates its validated findings into one deduplicated, exploit-intel-prioritised queue alongside SAST/SCA/IaC/container results, and adds versioned VEX, audit trail, EOL and SSVC policy that a single-purpose secret scanner does not cover.

No migration, no rip-and-replace. Betterleaks keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Betterleaks results in Vulnetix

Upload Betterleaks SARIF, JSON, CSV output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Betterleaks documentation ↗  ·  Source repository ↗

Wire Betterleaks into your CI/CD pipeline →