Betterleaks: Gitleaks creator's open-source secrets scanner successor

What it is

Betterleaks v1.0.0, released by Gitleaks' original author (now Head of Secrets Scanning at Aikido). The summary covers its detection features; what it can't carry is the why and the governance, both of which bear directly on adoption risk.

The creator states plainly he no longer has full control over the Gitleaks repo and name — Betterleaks is the fresh start that gives him back control. For an engineer deciding whether to migrate, that reframes the choice: Gitleaks (26M GitHub downloads, most-starred secrets scanner) keeps its momentum but not its founder; Betterleaks gets the founder but starts from zero adoption.

Governance and continuity

Betterleaks is MIT-licensed and, per the author, independent of Aikido — Aikido sponsors it but the project is not dependent on Aikido. It ships with four maintainers rather than Gitleaks' effectively single-maintainer model, cited explicitly as a bet on stability, governance, and longevity:

• Richard Gomez — RBC Global Security, longtime Gitleaks contributor, MSRC 2024 Most Valuable Researcher.
• Braxton Plaxco — Red Hat incident response; runs Red Hat's secret-detection program (LeakTK framework) on these tools.
• Ahrav Dutta — Amazon engineer focused on high-performance scanning.

The presence of RBC and Red Hat security staff as maintainers is the concrete continuity signal a lone-founder rewrite usually lacks.

Migration cost

The drop-in claim is specific: existing Gitleaks CLI options continue working and existing configs work out of the box, so migration is meant to be a binary swap with no config rewrite. Planned v2.x config changes (flattened config, CEL-based filtering replacing allowlists) are stated to remain fully backwards compatible with both v1 and old Gitleaks configs — so adopting now does not strand you on a config format.

Agentic use — the design intent

The page argues Betterleaks is built to be driven by AI coding agents (Claude Code, Codex, Cursor) the way they reach for grep: CLI flags tightly control output so the agent gets its answer without blowing the token budget. Suggested patterns: register it as a tool and have the agent scan any code it generates, or invoke it from a bug-bounty agent when it hits an interesting file. This is positioning, not a benchmark — treat it as design intent, not measured behavior.