Best Secrets Scanning Tools for Git, CI, and History
Catch the key before merge, in CI, and in history you already pushed.
GitGuardian counted 28.65 million new hardcoded secrets on public GitHub in 2025, up 34% year over year.
When the same research retested credentials that were valid in 2022, more than 64% were still active in January 2026. Rotation is the expensive part; a green CI job that never scanned history is the cheap lie.
Most teams already have a pre-commit hook somewhere in a wiki, or a weekly digest from the host. Those controls look fine while the key that merged at 4pm is still live in a fork. Secrets scanning is the gate that fails the next commit, the CI job that blocks the PR, and the history pass that finds what already escaped. The vault that issues the key is a different job on secrets management tools. Non-human identity inventories live on their own list.
The split on this shortlist is simple: scanners you run yourself for a commit gate, scanners that verify whether a finding is still live, and hosted platforms that own triage after the alert.
How we evaluated
We read first-party docs, licenses, and release notes. We asked whether the tool fails a commit or only warns, whether it can scan git history, whether it verifies credentials against a provider, and whether remediation sits in the same product or in a wiki you write later. Marketing pages count as claims, not as proof two tools do the same work.
| Tool | Best for | What to check |
|---|---|---|
| GitGuardian | Platform detect-to-remediate loop | Commercial · ggshield CLI · SaaS triage |
| TruffleHog | History scans with live verification | AGPL-3.0 · Enterprise available · verify |
| Gitleaks | Lightweight pre-commit and CI gate | MIT · TOML rules · no live verify |
| Checkmarx Secrets Detection | AppSec platform secrets (Spectral lineage) | Commercial · Checkmarx One · IDE + history |
| Semgrep Secrets | Context-aware secrets beside Semgrep Code | Commercial · semantic + local validate |
| detect-secrets | OSS gate with a committed baseline | Apache-2.0 · Yelp · pre-commit |
GitGuardian
Best for a platform detect-to-remediate loop
GitGuardian is the dedicated secrets platform: public monitoring, private-repo coverage, honeytokens, and a remediation desk. ggshield is the CLI path into the same engine for pre-commit, CI, repo, and Docker scans.
Their annual sprawl report is how most teams learn the public-GitHub number. The product job is what happens after the alert: validity, playbooks, and ownership, not only another regex match in CI.
Key features:
- ggshield for pre-commit, CI, repo, and Docker layer scans
- SaaS incident triage with validity checks and ignore paths
- Public monitoring plus private repository coverage
- Honeytoken and rotation-playbook extensions on the platform
Why we like it:
When the requirement is “find it, prove it is live, and route a human,” GitGuardian is the full loop. OSS tools still need that desk.
Limits:
Commercial platform pricing. ggshield calls their API; the free plan documents 1,000 API calls per month for small orgs. The detection library behind the API is proprietary even though the CLI wrapper is open source.
License or pricing: Commercial. Free plan for individuals and orgs with 25 developers or fewer (1,000 API calls/month on the FAQ we read). Business trial available.
TruffleHog
Best for history scans with live verification
TruffleHog digs git history, filesystems, Docker images, and other sources, then verifies many detector hits against the provider API. That verification step is why history audits become triageable instead of a wall of entropy matches.
Pre-commit and pre-receive hooks cover prevention. Enterprise Analyze adds blast-radius context for keys that are still live. The OSS CLI is the path most teams start on.
Key features:
- Hundreds of detectors with programmatic verification
- Git history, filesystem, and Docker scanning paths
- Pre-commit and pre-receive prevention hooks
- Enterprise Analyze for permissions a live key can reach
Why we like it:
When the question is “which of these findings can still authenticate,” TruffleHog is the OSS answer with a commercial ladder.
Limits:
Verification can hit provider rate limits. Generic passwords without detector context often miss, especially under --only-verified. AGPL-3.0 on the OSS CLI matters for some redistribution policies.
License or pricing: AGPL-3.0 open-source CLI. Commercial Enterprise for Analyze and support. No public list price on the Enterprise page we read.
Gitleaks
Best for a lightweight pre-commit and CI gate
Gitleaks is the fast Go binary most teams mean when they say “put a secrets scanner in pre-commit.” TOML rules are easy to audit. Gitleaks-Action covers pull requests and on-demand org scans.
It does not verify credentials against live providers. That is the trade: speed and a deterministic rule file, not a validity ping. Allowlists and custom rules are how you keep the gate from becoming noise.
Key features:
- Scan git repos, files, and directories from one CLI
- TOML configuration and allowlists you can review in PR
- Official Gitleaks-Action for GitHub pull requests
- MIT license; wide Homebrew and container adoption on their site
Why we like it:
It is the commit gate you can install tonight without a sales call. Teams that later add verification still keep Gitleaks on the hot path.
Limits:
No live verification. Default rules need tuning. Gitleaks-Action needs a free org license key for GitHub organization repos. Betterleaks, from the same author and sponsored by Aikido, is a newer successor shape; Gitleaks remains the binary most repos already pin.
License or pricing: MIT. Gitleaks-Action free for personal accounts; organization Action requires their free license form.
Checkmarx Secrets Detection
Best for AppSec-platform secrets with Spectral lineage
Checkmarx acquired Spectral. The live product is Secrets Detection inside Checkmarx One: IDE warnings, pre-commit blocking, history scans, CI policy, and guided rotation links. Docs gate the scanner behind SCS and Enterprise Secrets entitlements.
First-party pages claim 170+ secret types, live validation, and correlation next to SAST and SCA findings. That is the mid-platform seat when secrets are one engine on an AppSec buy you already run.
Key features:
- IDE and pre-commit prevention before the remote sees the key
- Full git history scanning on server-hosted and local repos
- Live validation to prioritize operative credentials
- Policy enforcement that can block PRs and break builds
Why we like it:
Spectral buyers who moved into Checkmarx One still need a named secrets engine. This is that engine, not a relabeled CSPM checkbox.
Limits:
Commercial, sales-quoted. Confirm Enterprise Secrets on the license card. Not a standalone Spectral SKU anymore.
License or pricing: Commercial Checkmarx One add-on. No public list price.
Semgrep Secrets
Best for context-aware secrets beside Semgrep Code
Semgrep Secrets adds semantic analysis and entropy on top of regex, then validates many tokens locally against the provider so the secret does not need to leave your infrastructure for the validity check. Findings show up in editor, PR, and pre-commit workflows.
The buy is usually the Semgrep platform pane you may already pay for SAST and SCA. Custom rules cover internal token shapes the default pack misses.
Key features:
- Semantic and data-flow analysis for credential use, not only string shape
- Local validation against providers for priority
- Pre-commit, IDE, and PR comments on the same engine family
- Custom rules for internal services
Why we like it:
When regex noise is why developers ignore the gate, semantic context is the mid-product answer that still sits next to code findings.
Limits:
Commercial. Detector breadth is narrower than a pure secrets specialist. Confirm Secrets is on the quote, not only Semgrep Code.
License or pricing: Commercial Semgrep platform. Demo and trial CTAs. No public per-seat list on the Secrets page we read.
detect-secrets
Best for an OSS gate with a committed baseline
detect-secrets is Yelp’s Apache-2.0 scanner built around a baseline file. Known findings are recorded so the hook fails on new secrets instead of re-litigating every old match on every commit.
Plugin-style detectors and a pre-commit integration are the operating model. It is process-heavy on purpose: the baseline is the audit trail.
Key features:
- Baseline file checked into the repo
- Pre-commit hook path for local prevention
- Plugin architecture for custom detectors
- Apache-2.0 license
Why we like it:
Baselines are the operational detail many regex gates leave as tribal knowledge. Here the file is the product.
Limits:
No SaaS triage desk and no live provider verification. You staff the baseline reviews. History archaeology is weaker than TruffleHog.
License or pricing: Apache-2.0. You run it.
How to choose a secrets scanning tool
Four questions before the quote. Names below are the shortlist, not a scored bake-off.
| Critical question | Why it matters | What to evaluate | Red flag |
|---|---|---|---|
| Do we need to fail the next commit, scan history, or both? | Prevention and archaeology are different controls. | Gitleaks, detect-secrets, ggshield for the gate. TruffleHog and platform history scans for what already landed. | A weekly digest sold as a commit gate. |
| Must findings prove the key is still live? | Expired keys drown triage. | TruffleHog verification. GitGuardian and Checkmarx validity. Semgrep local validate. | Entropy-only alerts with no validity path. |
| Is this a module on AppSec we already pay for? | A fourth dashboard without export is debt. | Checkmarx Secrets Detection if Checkmarx One is live. Semgrep Secrets if Semgrep Code is live. GitGuardian if secrets are the buy. | A SAST SKU that only mentions secrets in a PDF. |
| Who owns allowlists, baselines, and rotation after the alert? | A gate without owners becomes --no-verify. | detect-secrets baselines. GitGuardian playbooks. TruffleHog remediation guides. | No named owner for ignores. |
What we left out
- GitHub Secret Protection and GitLab Secret Detection: host-native controls. Useful, and covered on the older singular shortlist under Application Security.
- Password managers and vaults: that is the store job on secrets management tools.
- NHI discovery platforms: different category on non-human identity tools.
- Betterleaks: promising Gitleaks-shaped successor from the same author. Too early for a shortlist seat while Gitleaks is still the default pin.
What practitioners argue about secrets scanning
Live threads keep returning to the same split: a fast regex gate everyone can run, versus verification and tickets that make rotation safe. The dissenting view is that free scanners only solve detection, and detection without an owner is noise.
Hacker News · Oct 2022
“To properly handle secret scanning requires calling live APIs to test if keys are real. And you need to have a way to file tickets when you do have findings… if you rotate a cred from production, that’s now an outage, so you need to coordinate multiple teams.”
The pushback in that thread is that the newer Go TruffleHog already verifies and stays usable at scale once tuned. Both sides agree free detection is not the whole job.
Stack Overflow · May 2023
“If Trufflehog still does not detect something for you, try to omit –only-verified or even use –no-verification flag. Trufflehog tries to verify the results to limit false positives.”
Operators learn that –only-verified can hide generic passwords the detectors never claimed to catch. Verification is a filter, not a promise of total coverage.
Put a commit gate on tonight with Gitleaks or detect-secrets. Add a verified history pass with TruffleHog or a platform desk when the backlog of old keys is the real risk. Keep the vault decision on the secrets management list.
FAQs
Is secrets scanning the same as secrets management?
No. Scanning finds credentials that landed in git, CI, or images. Management stores and rotates secrets the app fetches. Use the secrets management list for vaults.
Is this the same page as secret-scanning-tools?
No. The singular URL is an earlier Application Security shortlist that leans on host-native GitHub and GitLab rows. This plural shortlist mixes GitGuardian, TruffleHog, Gitleaks, Checkmarx Secrets Detection, Semgrep Secrets, and detect-secrets.
Does Checkmarx still sell Spectral as a standalone product?
No. Spectral was acquired. The live Checkmarx surface is Secrets Detection inside Checkmarx One, typically behind an Enterprise Secrets entitlement.
Is this a scored bake-off?
No. Order is editorial.
