Application Security
Secret scanning tools that catch the next leaked key (2026)
A 2026 shortlist of scanners for git history you already own. Public docs, not an extraction tutorial.
Expertise: Application Security · Level: Intermediate · 12 min read
The leak is usually a commit, not a movie villain.
Someone pasted a cloud key into a fixture and pushed. Secret scanning is regex and entropy on remotes you operate. It is not a tutorial for lifting keys from a stranger’s repo.
Six scanners. One Go hook. One verifier. One committed baseline. Two platform buttons. One multi-source desk. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Gitleaks | Fast hook on a repo you own | MIT |
| TruffleHog | Verified findings on remotes you own | AGPL-3.0 |
| detect-secrets | A baseline file you can review | Apache-2.0 |
| GitHub Secret Protection | Push protection on the remote you already use | GitHub terms |
| GitGuardian | A desk when keys also live in chat | Commercial (ggshield MIT) |
| GitLab Secret Detection | Pipeline scan when the remote is GitLab | GitLab terms |
Gitleaks
Best for fast hook on a repo you own
Gitleaks scans git, files, and stdin. Config is TOML. Pre-commit and CI are first-class. It does not verify live keys by default.
Key features
- TOML rules and allowlist
- Pre-commit and CI
- SARIF out
- You own the binary
Why we like it
This is the hidden gem. Install it before you argue about a third vendor.
Limits
False friends in the first week. No live verify unless you add it.
TruffleHog
Best for verified findings on remotes you own
TruffleHog can verify some secrets against the real API when you ask. That is powerful and easy to point at the wrong org.
Key features
- Optional live verify
- Git, S3, and other sources
- JSON out
- SaaS if you want the desk
Why we like it
A verified key is a page, not a trophy. Run it from a box allowed to talk to those APIs.
Limits
Verify calls out. AGPL. Stay on remotes you operate.
detect-secrets
Best for a baseline file you can review
Yelp’s tool commits a .secrets.baseline. CI fails on new candidates. It is a conversation, not a firehose.
Key features
- Committed baseline
- pre-commit hook
- Plugins
- Apache-2.0
Why we like it
When a team fights about false friends, a file you can review is healthier than a Slack maybe.
Limits
Python env. No live verify. Baseline drift is a review job.
GitHub Secret Protection
Best for push protection on the remote you already use
Public repos get partner patterns. Private repos and push protection sit on a SKU. Turn it on before you buy a third scanner.
Key features
- Partner patterns
- Push protection
- Alerts in the repo
- No extra binary
Why we like it
It has saved more Friday nights than any blog post I have written.
Limits
GitHub-only. SKU maze. Remotes elsewhere need another tool.
GitGuardian
Best for a desk when keys also live in chat
SaaS across git, Slack, and tickets. ggshield is the CLI. The timeline is why you pay.
Key features
- Multi-source incidents
- ggshield CLI
- Playbooks they sell
- API
Why we like it
The last leak was a paste, not a commit. That is the honest reason this row exists.
Limits
Another SaaS. Cost. Start with git if chat is clean.
GitLab Secret Detection
Best for pipeline scan when the remote is GitLab
Historical and pipeline detection inside GitLab. Push protection is a later tier. Enable it the same week you enable SAST.
Key features
- CI analyzer
- MR widget
- Historical scan
- Push protection on a tier
Why we like it
One platform, one bill, fewer agents if the remote is already GitLab.
Limits
GitLab-only. Read the tier page before you promise push protection.
What the internet thinks about secret scanning
Secret-scan threads treat the hook as cheaper than the incident. We agree. A finding without rotation is a souvenir.
toomuchtodo on Hacker News, Jul 2026: “Gitleaks is a fine tool to use, I would recommend its use.”
Prove Gitleaks still publishes
Confirm Gitleaks still publishes. Run detect on a repo you own. Do not scan a remote you cannot write.
git ls-remote --heads https://github.com/gitleaks/gitleaks.gitFAQs
Pre-commit or history?
Both. The hook stops the next leak. History finds the last one.
Will the tool revoke the key?
Some vendors can. Most open tools only alert. Rotation is still your job.
Can I scan a public stranger’s repo?
Only if their license and your counsel say so. This list assumes remotes you operate.
Is this a scored bake-off?
No. Order is editorial.
