secret.private_key
A "-----BEGIN ... PRIVATE KEY-----" PEM block appears in the text.
Gitleaks rule private-key.
What it looks at#
A PEM-armoured private key block — -----BEGIN, any of the usual key-type labels (RSA,
EC, OPENSSH, PGP, encrypted PKCS#8, and so on) and the closing -----END ... KEY-----. No
entropy check: the PEM structure itself is the signal. Two formats outside PEM are also
recognised under this code: PuTTY .ppk files (a PuTTY-User-Key-File-2: or -3: header
followed by a Private-Lines: section; a public-only file does not fire), and a kubeconfig
client-key-data: field whose base64 value decodes to a BEGIN ... PRIVATE KEY block.
A key pasted without its END line is not matched.
Why it matters#
A private key is immediately usable — unlike most other findings here, there is no intermediate step (no API call, no login flow) between having the text and using the key. It authenticates whoever holds it, permanently, until the key is rotated.
What to do#
Critical severity. Treat any hit as a live incident: rotate the key and audit anywhere the text containing it might have been stored, logged or forwarded — not just where it was submitted to this gate.