Secrets Scanning

gitleaks28.8k★

Gitleaks scans your repository for secrets that should never have been committed. It runs locally or in CI, walks every commit in the history rather than just the working tree, and flags anything that looks like a credential. MIT licensed, written in Go, and fast enough to scan an entire repo in seconds. There is nothing to host. It is a single binary you run as a pre-commit hook, a CI step, or a one-off history scan. It ships with more than 200 built-in rules covering AWS keys, Stripe tokens, private keys, and JWTs, and you add your own patterns through a TOML config. Expect to spend real time on the allowlist, because the first full-history scan on an old repo will find test fixtures and example keys and shout about all of them. Here is the thing that changed, and it matters more than any pricing detail: the maintainer has declared Gitleaks feature complete. No new features are being merged, future releases are security patches only, and the focus has shifted to a successor project called Betterleaks. The tool still works, it is still free, and the rule set is still good. So the catch is a planning question rather than a bug. Feature complete is not abandoned, and for secret scanning it is a defensible place to land. But new credential formats keep appearing, and a project that does not merge new rules will drift behind them. Keep using it, keep your custom rules current, and watch where Betterleaks goes before you standardize on either one for the next five years.

trufflehog27.5k★

TruffleHog finds leaked secrets in your code (API keys, passwords, tokens) and verifies whether they're actually live and valid. That's the key difference from other secret scanners. Instead of flagging every high-entropy string, TruffleHog checks if that AWS key still works, if that Slack token is active, if that database password connects. AGPL v3, Go. Scans Git repos, GitHub/GitLab orgs, S3 buckets, Docker images, and filesystems. 800+ credential detectors with built-in verification. The CLI is fast and the output tells you exactly which secrets are verified-active vs. unverified. The open source CLI is free under AGPL. TruffleSecurity offers an Enterprise platform with a dashboard, API, team management, and continuous monitoring. Pricing is custom. For solo developers and small teams: the CLI is everything you need. Run it on your repos, pipe it into CI, done. Medium teams: the CLI still works, but the Enterprise dashboard adds visibility. Large teams: Enterprise for org-wide scanning and compliance reporting. The catch: AGPL license. If you're building a product that incorporates TruffleHog, the copyleft terms require you to open source your code. For internal use it doesn't matter, but SaaS products need to be careful. Also, verification means TruffleHog actually attempts to authenticate with found credentials. In rare cases, this could trigger rate limits or account lockouts on the service being tested.

detect-secrets4.6k★

detect-secrets stops credentials from getting committed to your repo in the first place. It scans code for things that look like passwords, API keys, and tokens, and it's built to run as a pre-commit hook so a leaked secret gets caught before it ever lands in git history. Open source, from Yelp, free. Its trick is a baseline file: it records the secrets it already knows about, including false positives you've marked, so it only alerts on new ones. That keeps it quiet enough to actually leave enabled, which is the whole game with secret scanning. Setup is a pip install and a pre-commit config, and it runs locally with no service. Fully free, no paid tier. It sits in a crowded space: Gitleaks and TruffleHog are the other open source options, and each has a slightly different angle. detect-secrets leans hardest into the pre-commit, baseline-driven workflow, which makes it a strong default for stopping leaks at the source rather than finding them after. The catch: it catches secrets that match its detectors and heuristics, not every possible secret. A credential in an unusual format can slip past, and the baseline approach means a secret already in your history won't get flagged. It's prevention going forward, not a cleanup tool for what already leaked.