When gitleaks is run in git mode, I think it would see the unix-style line endings of the file as it is stored in git. When gitleaks is instead run in dir mode, it would see the local line endings, e.g. \r\n on windows.

Not sure if this is actually how it works, but if so, it might make sense to normalize line endings in gitleaks before executing the regex, to avoid such surprises?

Originally posted by @Ben-grmbl in #1637 (comment)

Related: #1565