Free secrets scanning is a real starting point. Code hosts scan public repositories at no cost, open source scanners run in your terminal and CI, and pre-commit hooks stop mistakes early. The limits show up in history coverage, private repositories, verification, triage workflow and reporting. Start free, then decide what gap costs you.
What free categories exist?
Built-in scanning on a code host. One major code host's documentation says secret scanning runs automatically and free for public repositories, and that default detection covers partner and provider secrets. It also says push protection for users is on by default for pushes to public repositories. Repository-level push protection is off by default and requires a separate secret protection product to be enabled, and extended options such as generic patterns, custom patterns and validity checks go beyond the default detection. The same documentation mentions a free report that scans an organization's code for leaked secrets. Plans change, so confirm on the current page. We fetched these pages on 18 October 2026.
Open source command line scanners. OWASP's cheat sheet says there are many approaches to detection and some very useful open source projects. They run locally or in CI, read files and often Git history, and cost nothing but setup time.
Pre-commit hooks. A local check that blocks a commit containing a likely secret. It catches the mistake before it leaves the laptop and depends on every developer installing it.
Editor extensions. Safeguard's extension for VS Code and Cursor offers a staged-commit secrets check, and the CLI can scan a working tree with its secrets detection option. Check current docs for plan terms, which we do not state.
Where do free options stop?
History. A secret deleted in the last commit still lives in earlier ones. Make sure your tool scans history, not just the current tree, and run it once across old repos.
Private and forgotten repos. Free host-level scanning may not reach private repos, forks, old branches or other platforms. Inventory your repositories first.
Verification. Many free scanners flag patterns without checking whether a key is live. Some commercial and platform tools make a low-privilege call to the issuer and mark findings verified or unverified. Without it, your team sorts live from dead by hand.
Triage and ownership. A free scanner produces a list. Someone must assign owners, track rotation and prove closure. Spreadsheets work until volume grows.
Other surfaces. Container image layers, build logs, packaged artifacts and chat tools hold secrets too. Free tools differ widely on what they read.
Support and rules. Custom patterns for internal tokens are usually possible, but tuning is on you.
Does scanning solve the problem?
No. Detection tells you a secret is exposed. The fix is revoke, rotate and replace, and the longer-term fix is to keep secrets out of code through a secrets manager, short-lived credentials and scoped tokens. OWASP's cheat sheet stresses regular rotation and prompt revocation of anything compromised.
When should you pay?
Pay when the gap costs more than the license. A good signal is repeated manual work: someone spends hours each week verifying findings, chasing owners, or answering auditors who ask for reports on time to revoke and open versus closed leaks. That is the work paid tools and platforms automate.
What to do
- Inventory every repository, including private, archived and forked.
- Turn on host scanning where it is free, and enable push protection for users.
- Run one open source scanner across the full history of each repo.
- Add a pre-commit hook and a CI check on pull requests.
- For every real finding, revoke and rotate first, then clean up.
- Track findings with an owner and a date in a shared sheet.
- Reassess paid options after a quarter, based on hours of manual triage.
Quick check
Is free secret scanning on private repos available?
It depends on the host and plan. One major host's docs say public repositories are scanned free, while repository-level protection must be enabled separately. Check the plan page.
If I delete a leaked key from the code, am I safe?
No. It stays in Git history and may already be copied. Revoke and rotate it.
Sources
- Code host docs: About secret scanning (docs.github.com)
- Code host docs: About push protection (docs.github.com)
- OWASP Secrets Management Cheat Sheet
- Safeguard docs: Secrets scanning
Last reviewed: 18 October 2026.
