The best secrets scanning tool is one that runs before a commit lands and again over your full history. Gitleaks and detect-secrets are light and free. TruffleHog verifies whether a found secret is live. ggshield and GitHub secret scanning are hosted services. Use a pre-commit hook plus a CI scan.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation, as of 19 October 2026.
Key takeaways
- Catching a secret at commit time is cheap. Removing it from history and rotating it is not.
- Verification (checking whether a key still works) helps you decide what to rotate first.
- A baseline file lets you adopt a scanner on a messy repo without fixing everything on day one.
- Any secret that reached a remote must be treated as leaked and rotated, even if you delete it.
How do secrets scanners find secrets?
They use patterns for known token formats, entropy checks for random looking strings, and keyword checks for variable names such as password. detect-secrets documents all three as plugin types. Some tools then call the issuing service to see if the secret still works.
Click through it at your own pace, or open it full screen.
How do the main tools compare?
| Tool | Type and license | Where it scans (per docs) | Distinctive feature |
|---|---|---|---|
| Gitleaks | Open source, MIT | Git history, directories, stdin | Baseline file; TOML rules; pre-commit and GitHub Action |
| TruffleHog | Open source, AGPL-3.0 | Git, cloud storage, Docker images, CI systems, Postman and more | Marks results verified, unverified or unknown |
| detect-secrets | Open source, Apache-2.0 | Code base, run as pre-commit | Baseline approach; about 27 plugins |
| git-secrets | Open source, Apache-2.0 | Commits, commit messages, merges via hooks | AWS patterns built in |
| ggshield | CLI for GitGuardian | Local files, CI, Docker images, pre-commit and pre-receive hooks | Needs a GitGuardian API key; detects 600+ secret types |
| GitHub secret scanning | GitHub feature | All branches of repository history, issues, pull requests, wikis | Free on public repositories; private repos need GitHub Secret Protection |
What are the limits of each tool?
Gitleaks says it is "feature complete" and that new releases will be security patches only, with the maintainer shifting focus to a project called Betterleaks. It is still a solid choice, but plan for that.
TruffleHog is AGPL-3.0 licensed and contributions require a CLA. Check that the license fits your use. Its README gives two different detector counts (over 800 secret types classified, over 700 detectors with verification), so do not quote one number without checking.
detect-secrets is built to stop new secrets entering a codebase rather than clean up old ones.
git-secrets warns that its AWS patterns "are not guaranteed to catch them all." Hooks must also be installed in every repo, so a package install alone protects nothing.
ggshield sends data to GitGuardian. Its docs say only metadata such as call time, request size and scan mode is stored, not your files or secrets.
GitHub secret scanning validates secrets with partners and can run validity checks, which may contact the issuing service.
How do I choose a secrets scanning tool?
- Does it run as a pre-commit hook and in CI?
- Can it scan full history, not just the latest commit?
- Does it support a baseline so old findings do not block new work?
- Can it verify a secret is live?
- Does any data leave your network, and are you comfortable with that?
- Can you add custom rules for your internal token formats?
- Does the license fit your company policy?
What should I do when a secret is found?
Rotate it first, then clean up. Revoke the credential at the provider, issue a new one, check logs for use of the old one, and only then consider rewriting history. Deleting the line does not make a pushed secret safe.
Safeguard is not a replacement for a dedicated secrets scanner in this comparison. It adds dependency and malicious package checks in the Gold registry at gold.safeguard.sh, and a free in-browser dependency scan at gold.safeguard.sh/scan that never sends your file to a server.
Frequently asked questions
Is there a free secrets scanner?
Yes. Gitleaks (MIT), detect-secrets (Apache-2.0) and git-secrets (Apache-2.0) are free. TruffleHog's open source edition is AGPL-3.0.
Does GitHub scan private repositories for free?
Per GitHub's docs, public repositories are scanned for free. Organization private and internal repositories need GitHub Secret Protection.
What is a baseline file?
It records secrets that already exist so future scans report only new ones. Gitleaks and detect-secrets both support it.
Do I need to rotate a secret I removed from the repo?
Yes, if it was ever pushed. Anyone who cloned or forked the repo may still have it.
Sources
- Gitleaks: https://github.com/gitleaks/gitleaks
- TruffleHog: https://github.com/trufflesecurity/trufflehog
- detect-secrets: https://github.com/Yelp/detect-secrets
- git-secrets: https://github.com/awslabs/git-secrets
- ggshield docs: https://docs.gitguardian.com/ggshield-docs/getting-started
- GitHub secret scanning: https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning
- Free dependency scan: https://gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
