detect-secrets

detect-secrets stops credentials from getting committed to your repo in the first place. It scans code for things that look like passwords, API keys, and tokens, and it's built to run as a pre-commit hook so a leaked secret gets caught before it ever lands in git history. Open source, from Yelp, free.

Its trick is a baseline file: it records the secrets it already knows about, including false positives you've marked, so it only alerts on new ones. That keeps it quiet enough to actually leave enabled, which is the whole game with secret scanning. Setup is a pip install and a pre-commit config, and it runs locally with no service.

Fully free, no paid tier. It sits in a crowded space: Gitleaks and TruffleHog are the other open source options, and each has a slightly different angle. detect-secrets leans hardest into the pre-commit, baseline-driven workflow, which makes it a strong default for stopping leaks at the source rather than finding them after.

The catch: it catches secrets that match its detectors and heuristics, not every possible secret. A credential in an unusual format can slip past, and the baseline approach means a secret already in your history won't get flagged. It's prevention going forward, not a cleanup tool for what already leaked.