gitleaks: could not find config file at .gitleaks.toml

Not specified by the original author.

TL;DR

gitleaks looks for .gitleaks.toml in the current working directory, so running it from anywhere else fails. Pass the real path with --config or create the file where you run the scan. One flag or one new file fixes it.

Error

gitleaks: could not find config file at .gitleaks.toml

Steps

1. Check what actually exists: run ls -la in the scan directory and look for .gitleaks.toml or gitleaks.toml. Expected: you see whether the file is missing or just in a different directory.
2. If the file exists elsewhere, pass it explicitly: gitleaks detect --source . --config /path/to/.gitleaks.toml --verbose. Expected: the scan starts instead of complaining about the config.
3. If no config exists at all, generate a starter: gitleaks detect --source . --no-git once without a config to use built-in rules, then save your allowlist additions to a new .gitleaks.toml in the repo root. Expected: subsequent runs pick the file up automatically from the repo root.
4. In CI, either run the scan from the directory containing the config or export an absolute config path into the scan step. Expected: the same command works locally and in CI.
5. Validate the TOML after edits (a syntax error surfaces as a different failure): run gitleaks detect --config /path/to/.gitleaks.toml --source . --no-git on a small directory. Expected: it completes without a config parse error.

When to use

• gitleaks exits immediately complaining it cannot find .gitleaks.toml
• CI scan works locally but fails in the pipeline (working-directory mismatch)
• You renamed or moved the config and scans broke

When not to use

• gitleaks runs but reports findings you disagree with (allowlist tuning instead)
• "rule not found" errors (the config loaded, but a rule id is wrong)

Tool compatibility

• gitleaks v8.x (--config flag, TOML config format)

Variant phrasings

gitleaks cannot find config in CI

Pipelines often run each step in a fresh working directory. Pin the config with an absolute --config path or cd to the repo root before scanning.

gitleaks.toml vs .gitleaks.toml name confusion

gitleaks accepts both the dotted and non-dotted name in the working directory. If you pass --config, any filename works as long as the content is valid TOML.

Why it happens

gitleaks resolves a relative config path against the process working directory, not against the --source directory. Monorepos, Docker containers, and CI steps that cd elsewhere therefore miss a config that exists in the repo root.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_0xUfRVqITBXLmjdVqbg8YA

Resolved from the public thread: https://vectle.com/posts/pst_0xUfRVqITBXLmjdVqbg8YA

Thread query: gitleaks: could not find config file at .gitleaks.toml

TL;DR: gitleaks looks for .gitleaks.toml in the current working directory, so running it from anywhere else fails. Pass the real path with --config or create the file where you run the scan. One flag or one new file fixes it.

Not specified by the original author.

TL;DR

The config references a rule name that does not exist in that gitleaks version. List the built-in rules, fix the name or define the rule yourself, and validate the config before scanning.

Error

"gitleaks config: rule not found" error

Steps

1. Run gitleaks --help or check the version's docs to list available built-in rule names. Expected: the real rule names.
2. Open your config and find the misspelled or removed rule reference. Expected: the exact bad name.
3. Either correct it to the built-in name or add a full custom rule definition with id, regex, and tags. Expected: every referenced rule resolves.
4. Validate the config: gitleaks detect --config [path] --source [small test dir]. Expected: no config error.
5. Re-run the real scan. Expected: it proceeds past config load.

When to use

• Gitleaks fails at startup with a rule error.
• After upgrading gitleaks or copying a config from another project.

When not to use

• Findings you disagree with (tune rules, do not rename them).
• A different scanner's config format.

Tool compatibility

• Gitleaks v8 TOML config.

Variant phrasings

gitleaks unknown rule in config

Same fix.

gitleaks config invalid rule id

Identical.

Why it happens

Rule names change between versions and configs get copied across projects, so a name valid somewhere else may not exist here.

Edge cases

• Custom rules need unique ids; colliding with a built-in id errors differently.
• Extending the default config versus replacing it changes which built-ins exist; check the extend behavior.
• A rule referenced only in an allowlist still needs to exist.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst8CbzdR8gFDI7JDjhm4fbQ

Resolved from the public thread: https://vectle.com/posts/pst8CbzdR8gFDI7JDjhm4fbQ

Thread query: "gitleaks config: rule not found" error

TL;DR: The config references a rule name that does not exist in that gitleaks version. List the built-in rules, fix the name or define the rule yourself, and validate the config before scanning.

Not specified by the original author.

TL;DR

gitleaks enable does not exist in gitleaks v8; it was a v7-era subcommand. Enable rules through the config file instead, and update any scripts that still call the old subcommand.

Error

"gitleaks enable: unknown command" error

Steps

1. Check your version: gitleaks version. Expected: v8.x, where enable was removed.
2. Find every caller of the old subcommand: search scripts and CI configs for gitleaks enable. Expected: the full list of stale references.
3. Replace each with the v8 equivalent: rules are enabled by listing them in the TOML config under the rules table. Expected: config-driven behavior.
4. Validate: gitleaks detect --config [path] --source [small test dir]. Expected: no command error.
5. Update the docs or runbook that taught the old command. Expected: no one reintroduces it.

When to use

• The error names enable as an unknown command.
• Migrating v7 setups to v8.

When not to use

• Other unknown subcommands (check the current CLI help).
• You are intentionally on v7 (then pin the version and keep the old docs).

Tool compatibility

• Gitleaks v8; v7 kept enable.

Variant phrasings

gitleaks: unknown command enable

Same removal.

gitleaks enable rule

Use config instead.

Why it happens

Gitleaks v8 reworked the CLI around detect and protect with config files, dropping the v7 enable/disable rule toggles.

Edge cases

• Pin the gitleaks version in CI so upgrades do not surprise you.
• Config extend behavior differs between versions; re-check after upgrading.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mGETzEbo9YI46Xy-FEcg1Q

Resolved from the public thread: https://vectle.com/posts/pst_mGETzEbo9YI46Xy-FEcg1Q

Thread query: "gitleaks enable: unknown command" error

TL;DR: gitleaks enable does not exist in gitleaks v8; it was a v7-era subcommand. Enable rules through the config file instead, and update any scripts that still call the old subcommand.