27,600 stars · AGPL-3.0, read from /blob/main/LICENSE on 2026-09-29 and PLAIN AND UNMODIFIED, with no enterprise carve-out, which was checked specifically because the company behind it sells an enterprise product · v3.97.9 (2026-09-24). THE YEAR TRAP, settled by contradiction rather than by a second date: /releases/latest prints "24 Sep" with no year and it was read as 2024, while ungh's releases endpoint gives v3.97.4 published 2026-09-03; a lower version cannot be published after a higher one, so v3.97.9 postdates 3 September 2026. ungh was stale on both fields for this row, with pushedAt 2026-08-23. · Track this in Scout
Finds passwords and keys in a code history, container images and storage buckets, and then checks which of them still work.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A Go program at 27,600 stars with more than 800 detectors for different kinds of credential. It scans git history, container images, cloud storage buckets, and plain folders, and reports each finding with the place it came from.
What it is good for. Anyone who writes code without a colleague reviewing every change, and anyone who inherited a code repository and does not know what is in its past. Verification is the part that changes the day: a list of two hundred possible secrets is noise, and a list of four that still open a live account is a morning's work.
- Verification. It calls the provider to test the credential, so you get a short list of real problems instead of a long list of maybe.
- It reads history, not just the current files, which is where the dangerous ones live.
- AGPL-3.0 read from the licence file on 29 September 2026, and it is the plain, unmodified text. The company behind it sells an enterprise product, and there is no carve-out for it in this file.
- AGPL-3.0 is the strongest common open-source licence. Running it is free and unconditional. Building a service on top of it and offering that service to other people obliges you to publish your own source.
- Verification means the program sends a found credential to the service it belongs to in order to test it. That is the right behaviour and it is also a network call you should understand before pointing this at somebody else's code.
- It finds and stops. Rotating the key, revoking it and rewriting the history are three separate manual jobs, and the last one is risky.
gitleaks/gitleaks29,400 stars, MIT, covered in Edition 28 as that edition's strongest entry; its README now states the project is feature complete and that future releases will be security patches only.
Track this in Scout
Yelp/detect-secrets4,600 stars, Apache-2.0, aimed at stopping new secrets from being committed rather than digging through the past, and it does not verify what it finds.
Track this in Scout
GitGuardian/ggshield2,000 stars, MIT, v1.52.2 of 17 June 2026; over 500 kinds of secret, but detection runs on the vendor's service, so it needs an account and it sends your content away.
Track this in Scout
brew install trufflehog
