27,600 stars · AGPL-3.0, read from /blob/main/LICENSE on 2026-09-29 and PLAIN AND UNMODIFIED, with no enterprise carve-out, which was checked specifically because the company behind it sells an enterprise product · v3.97.9 (2026-09-24). THE YEAR TRAP, settled by contradiction rather than by a second date: /releases/latest prints "24 Sep" with no year and it was read as 2024, while ungh's releases endpoint gives v3.97.4 published 2026-09-03; a lower version cannot be published after a higher one, so v3.97.9 postdates 3 September 2026. ungh was stale on both fields for this row, with pushedAt 2026-08-23. · Track this in Scout
Finds passwords and keys in a code history, container images and storage buckets, and then checks which of them still work.
▶Repo detailsspecs
gitleaks/gitleaks29,400 stars, MIT, covered in Edition 28 as that edition's strongest entry; its README now states the project is feature complete and that future releases will be security patches only.
Track this in Scout- Yelp/detect-secrets
4,600 stars, Apache-2.0, aimed at stopping new secrets from being committed rather than digging through the past, and it does not verify what it finds.
Track this in Scout - GitGuardian/ggshield
2,000 stars, MIT, v1.52.2 of 17 June 2026; over 500 kinds of secret, but detection runs on the vendor's service, so it needs an account and it sends your content away.
Track this in Scout
