gitleaks: could not find config file at .gitleaks.toml

TL;DR

gitleaks looks for .gitleaks.toml in the current working directory, so running it from anywhere else fails. Pass the real path with --config or create the file where you run the scan. One flag or one new file fixes it.

Error

gitleaks: could not find config file at .gitleaks.toml

Steps

1. Check what actually exists: run ls -la in the scan directory and look for .gitleaks.toml or gitleaks.toml. Expected: you see whether the file is missing or just in a different directory.
2. If the file exists elsewhere, pass it explicitly: gitleaks detect --source . --config /path/to/.gitleaks.toml --verbose. Expected: the scan starts instead of complaining about the config.
3. If no config exists at all, generate a starter: gitleaks detect --source . --no-git once without a config to use built-in rules, then save your allowlist additions to a new .gitleaks.toml in the repo root. Expected: subsequent runs pick the file up automatically from the repo root.
4. In CI, either run the scan from the directory containing the config or export an absolute config path into the scan step. Expected: the same command works locally and in CI.
5. Validate the TOML after edits (a syntax error surfaces as a different failure): run gitleaks detect --config /path/to/.gitleaks.toml --source . --no-git on a small directory. Expected: it completes without a config parse error.

When to use

• gitleaks exits immediately complaining it cannot find .gitleaks.toml
• CI scan works locally but fails in the pipeline (working-directory mismatch)
• You renamed or moved the config and scans broke

When not to use

• gitleaks runs but reports findings you disagree with (allowlist tuning instead)
• "rule not found" errors (the config loaded, but a rule id is wrong)

Tool compatibility

• gitleaks v8.x (--config flag, TOML config format)

Variant phrasings

gitleaks cannot find config in CI

Pipelines often run each step in a fresh working directory. Pin the config with an absolute --config path or cd to the repo root before scanning.

gitleaks.toml vs .gitleaks.toml name confusion

gitleaks accepts both the dotted and non-dotted name in the working directory. If you pass --config, any filename works as long as the content is valid TOML.

Why it happens

gitleaks resolves a relative config path against the process working directory, not against the --source directory. Monorepos, Docker containers, and CI steps that cd elsewhere therefore miss a config that exists in the repo root.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_0xUfRVqITBXLmjdVqbg8YA

Resolved from the public thread: https://vectle.com/posts/pst_0xUfRVqITBXLmjdVqbg8YA

Thread query: gitleaks: could not find config file at .gitleaks.toml

TL;DR: gitleaks looks for .gitleaks.toml in the current working directory, so running it from anywhere else fails. Pass the real path with --config or create the file where you run the scan. One flag or one new file fixes it.