Scan

pipeleek gluna scan

Scan public GitLab pipelines without an account

Synopsis

Scan public GitLab project pipelines for secrets in job traces and optionally artifacts.

This command does not require an API token and only covers resources that are publicly accessible. Dotenv artifacts are intentionally not scanned in this mode because they require a UI session cookie.

1	`pipeleek gluna scan [flags]`

Examples

# Scan public project pipelines and traces
pipeleek gluna scan --url https://gitlab.example.com

# Scan public pipelines with artifacts and tuned performance
pipeleek gluna scan --url https://gitlab.example.com --artifacts --job-limit 10 --max-artifact-size 200Mb --threads 8

# Scan one public repository
pipeleek gluna scan --url https://gitlab.example.com --repo mygroup/myproject

# Scan all public repositories in a namespace
pipeleek gluna scan --url https://gitlab.example.com --namespace mygroup

Options

  -a, --artifacts                  Scan artifacts
      --confidence strings         Filter for confidence level, separate by comma if multiple. See readme for more info.
  -h, --help                       help for scan
      --hit-timeout duration       Maximum time to wait for hit detection per scan item (e.g., 30s, 2m, 1h) (default 1m0s)
  -j, --job-limit int              Scan a max number of pipeline jobs - trade speed vs coverage. 0 scans all and is the default.
      --max-artifact-size string   Maximum artifact size to scan. Larger files are skipped. Format: https://pkg.go.dev/github.com/docker/go-units#FromHumanSize (default "500Mb")
  -n, --namespace string           Namespace to scan (all public repos in the namespace will be scanned)
  -q, --queue string               Relative or absolute folderpath where the queue files will be stored. Defaults to system tmp. Non-existing folders will be created.
  -r, --repo string                Single public repository to scan, format: namespace/repo
  -s, --search string              Query string for searching public projects
      --threads int                Number of concurrent threads for scanning (default 4)
      --truffle-hog-verification   Enable TruffleHog credential verification to actively test found credentials and only report verified ones (enabled by default, disable with --truffle-hog-verification=false) (default true)
  -u, --url string                 GitLab instance URL

Options inherited from parent commands

      --color                   Enable colored log output (auto-disabled when using --logfile) (default true)
      --config string           Config file path. Example: ~/.config/pipeleek/pipeleek.yaml
      --http-timeout duration   HTTP request timeout, e.g. 30s or 2m (default: no timeout)
      --ignore-proxy            Ignore HTTP_PROXY environment variable
      --json                    Use JSON as log output format
      --log-level string        Set log level globally (debug, info, warn, error). Example: --log-level=warn
  -l, --logfile string          Log output to a file
      --proxy string            Proxy URL, e.g. http://127.0.0.1:8080 or socks5://127.0.0.1:1080 (takes precedence over HTTP_PROXY)
      --tls-verification        Enable TLS certificate verification (by default verification is skipped to support self-signed certificates)
  -v, --verbose                 Enable debug logging (shortcut for --log-level=debug)