detect-secrets
A command-line tool from Yelp that detects and prevents secrets such as keys being committed to code.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get detect-secrets
Package managers
- Homebrew
brew install detect-secrets
About detect-secrets
detect-secrets scans a code repository for credentials, API keys and other secrets that should not be committed. It keeps a baseline file of known findings, so existing results can be reviewed once while new secrets are flagged as they appear.
It ships with pre-commit hook definitions, so it can block a commit that introduces a secret before the secret reaches the repository. It is written in Python and suits teams that want a check they can run locally and in CI.
Strengths
- Baseline file separates known findings from new ones
- Works as a pre-commit hook to stop leaks before they land
- Runs locally with no service to sign up for
Limitations
- Pattern-based detection can produce false positives
- Command-line only, no graphical interface
Details
- Pricing
- FreeFree and open source.
- License
- Apache-2.0
- Developer
- Yelp
- Platforms
- Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Development teams that want to keep credentials out of their Git repositories
- Categories
- Security tools, Developer tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to detect-secrets
Compare allSoftware that can replace detect-secrets for an important use case, and what changes if you switch.
Gitleaks
Scans Git repositories, files and pipelines for leaked secrets.
Gitleaks scans full commit history as well as files and pipelines, running as a pre-commit hook or CI step with configurable rules.
TruffleHog
Find exposed credentials in repositories and other data sources.
TruffleHog finds exposed credentials across repositories and other data sources, with some verification features that contact external services.
Similar software
Related functionality, not necessarily a direct replacement.
