What causes "error reading file: %w" in gitleaks/gitleaks?

Check the template file exists at the given path from the directory you run gitleaks in

error reading file: %w

Error message

error reading file: %w

What it means

NewTemplateReporter could not read the Go text/template file passed via --report-template. os.ReadFile failed on the path - missing, wrong directory, or unreadable. Unlike error 37 this one wraps the OS error (%w), so errors.Is(err, fs.ErrNotExist) works.

Source

Thrown at report/template.go:26

	"text/template"

	"github.com/Masterminds/sprig/v3"
)

type TemplateReporter struct {
	template *template.Template
}

var _ Reporter = (*TemplateReporter)(nil)

func NewTemplateReporter(templatePath string) (*TemplateReporter, error) {
	if templatePath == "" {
		return nil, errors.New("template path cannot be empty")
	}

	file, err := os.ReadFile(templatePath)
	if err != nil {
		return nil, fmt.Errorf("error reading file: %w", err)
	}
	templateText := string(file)

	// TODO: Add helper functions like escaping for JSON, XML, etc.
	t := template.New("custom")

	funcMap := sprig.TxtFuncMap()
	delete(funcMap, "env")
	delete(funcMap, "expandenv")
	delete(funcMap, "getHostByName")

	t = t.Funcs(funcMap)
	t, err = t.Parse(templateText)
	if err != nil {
		return nil, fmt.Errorf("error parsing file: %w", err)
	}
	return &TemplateReporter{template: t}, nil
}

View on GitHub (pinned to b58d3f102c)

Solutions

Check the template file exists at the given path from the directory you run gitleaks in
Use an absolute path or ship the template inside the repo
After the read succeeds, parse errors from bad template syntax will surface separately - fix those next

Example fix

# before
gitleaks git --report-template report.tmpl --report-path out.txt .
# report.tmpl lives in templates/

# after
gitleaks git --report-template templates/report.tmpl --report-path out.txt .

Defensive patterns

Strategy: validation

Validate before calling

// Verify the template file exists before constructing the reporter.
if templatePath != "" {
    if _, err := os.Stat(templatePath); err != nil {
        return fmt.Errorf("report template %q missing: %w", templatePath, err)
    }
}

Try / catch

r, err := report.NewTemplateReporter(p)
if err != nil {
    if errors.Is(err, fs.ErrNotExist) {
        // path problem: check working directory or use an absolute path
    }
    return err // other errors: template parse failures
}

Prevention

Keep template files inside the repo and reference them by stable relative or absolute path
Run gitleaks from the repo root in CI so relative paths resolve
Note sprig's env/expandenv/getHostByName are deleted from the func map - do not use them in templates

When it happens

Trigger: Running gitleaks with --report-template custom.tmpl when the file does not exist at that path, typically a relative path resolved against the wrong working directory.

Common situations: Template files kept outside the repo, CI steps that skip the template checkout, or typos in the path. The empty-path case is a separate earlier error ('template path cannot be empty').

Related errors

AI-assisted analysis of gitleaks/gitleaks@b58d3f102c (2026-08-15). Data as JSON: /api/errors/d239cd320d457988. Report an issue: GitHub.