# gitleaks "leaks found" exit code 1 fails the build in CI

> Fix gitleaks "leaks found: N" with exit code 1 in CI - gitleaks matched one or more secret rules in the scanned history and exits non-zero to block the pipeline.

Source: https://latchkey.dev/learn/ci-integrations/gitleaks-leaks-found-exit-code-1-in-ci  
Updated: 2026-06-30

gitleaks scanned your commits, matched at least one detection rule, printed "leaks found: N" and exited with code 1. In CI, exit 1 fails the step by design so the secret is not merged.

## Make the gate meaningful

- Fail the build on the severity you actually intend to block, and set it explicitly. A scanner that reports without failing is documentation, not a gate.
- Scan the artifact you ship, not the source tree. A vulnerability in a base image will not appear in a source scan.
- Pin the scanner version and its database snapshot for reproducibility, then update deliberately; a floating database turns an unrelated push into a red build.
- Give the job a way to record accepted risk, or people will disable the gate rather than triage it.

## FAQ

### What causes gitleaks "leaks found" exit code 1 fails the build in CI?

There are 2 common causes: a real secret is present in the scanned history and a false positive from a broad generic rule. gitleaks matched a rule such as aws-access-token or generic-api-key against a value in a tracked file or a past commit, so it reports a leak.

### How do I fix gitleaks "leaks found" exit code 1 fails the build in CI?

There are 2 fixes depending on which cause you have: triage each finding, then remove or allowlist it and confirm the finding locally before pushing. Work through them in order, since the first is the most common.

### What does gitleaks "leaks found" exit code 1 fails the build in CI actually mean?

The gitleaks step ends with a WRN line "leaks found: 3" and "Error: Process completed with exit code 1".

### How do I stop gitleaks "leaks found" exit code 1 fails the build in CI happening again?

Keep a reviewed .gitleaks.toml allowlist for known fixtures. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt