Buyer's guide · updated September 2026
The best secret scanning tools in 2026
Eight tools for finding leaked API keys, tokens and passwords, compared on what they scan, what is free, and whether they help you fix the leak. We make one of them. It is listed first with its limits stated, and the honest answer for most people is that they need two of these.
- Keys in your code and your deployed app, with the fix: Prbl
- Scan git history, free and fast: gitleaks
- Know which leaked keys still work: TruffleHog
- Organisation-wide monitoring and incidents: GitGuardian
- Every repo, turn it on today: GitHub secret scanning
At a glance
| Tool | Scans | Free? |
|---|---|---|
| Prbl Secret scanner for AI-built apps, code and live | Current source tree, deployed app's JavaScript and exposed files | Free scan with no account; free GitHub Action on every PR |
| GitGuardian Secrets detection platform | Git history across repos, public GitHub monitoring, CI, Docker images, Slack and Jira | Free tier for individuals and small teams |
| gitleaks Open-source git secret scanner | Git history, working tree, stdin | Fully open source |
| TruffleHog Open-source scanner with credential verification | Git, GitHub orgs, S3, GCS, Docker images, filesystems, Slack, Jira | Open-source CLI; enterprise platform is paid |
| GitHub secret scanning Built into GitHub | Pushes and history on GitHub | Free on public repos, including push protection; private repos need GitHub Code Security |
| detect-secrets Yelp's baseline-driven scanner | Working tree, with a baseline file of known findings | Open source |
| Semgrep Secrets Secrets inside the Semgrep platform | Source code in CI | Part of paid Semgrep plans |
| Aikido Security Secrets as part of an all-in-one platform | Repos and containers | Free tier for small teams |
Prbl
Best for: Developers shipping with Cursor, Claude, Lovable or Bolt who want the leak found in the code, in the deployed JavaScript, and fixed. Free: Free scan with no account; free GitHub Action on every PR.
- Only tool on this list that checks the deployed app for keys that already shipped to the browser
- Classifies public-by-design keys (Supabase anon, Firebase) as verify-this rather than false alarms
- Catches the fallback pattern process.env.SECRET || 'dev' and NEXT_PUBLIC_ leaks that regex scanners miss
- Fix prompt per finding; the rewriter moves the secret and verifies
- Does not scan git history; pair with gitleaks for that
- Provider coverage is tuned to what AI-built apps use, not hundreds of detectors
- Python, JavaScript and TypeScript only
GitGuardian
Best for: Security teams that need organisation-wide monitoring of every repo, including public GitHub, with incident workflows. Free: Free tier for individuals and small teams.
- Hundreds of detectors with validity checks that test whether a key still works
- Monitors public GitHub for your organisation's leaked secrets
- Incident management: assign, resolve, revoke
- Pre-commit hooks via ggshield
- Priced per developer at scale
- Secrets only; no code, auth or live-app checks
- Setup and triage is a real workflow for a solo developer
gitleaks
Best for: Anyone who wants fast, free scanning of git history in CI or a pre-commit hook. Free: Fully open source.
- Single binary, very fast, runs anywhere
- Good default rules plus easy custom regexes
- Pre-commit and GitHub Action integrations
- The standard answer to scan a repo's history
- Regex only; no validity checks, so placeholders and test keys show up
- No dashboard or workflow; output is a report
- Cannot see what shipped to the browser
TruffleHog
Best for: Teams that want to know which leaked keys are live, across git, S3, Docker and more. Free: Open-source CLI; enterprise platform is paid.
- Verifies credentials against the provider so you triage real keys first
- Widest range of sources of the open-source tools
- Active detector library
- Enterprise version adds monitoring and remediation
- Verification means it calls provider APIs with your keys; understand that before running it
- Slower than gitleaks on large histories
- Enterprise pricing is opaque
GitHub secret scanning
Best for: Every repo on GitHub; it should simply be on. Free: Free on public repos, including push protection; private repos need GitHub Code Security.
- Push protection blocks a commit containing a known token format before it lands
- Partner program: providers are notified and can revoke automatically
- Zero setup on public repos
- Copilot-based detection for unstructured secrets like passwords
- Known provider formats; generic secrets and fallback defaults are hit or miss
- Private repos are priced per active committer
- Only sees what is pushed to GitHub
detect-secrets
Best for: Teams with an existing codebase who want to stop new secrets without cleaning up old ones first. Free: Open source.
- Baseline model: audit what exists once, then fail only on new secrets
- Entropy-based detection catches non-standard formats
- Plugin architecture
- Less active development than gitleaks or TruffleHog
- Entropy detection is noisy without tuning
- No history scanning by default
Semgrep Secrets
Best for: Teams already on Semgrep Code who want secrets in the same dashboard. Free: Part of paid Semgrep plans.
- Validity checks reduce noise
- Same rules engine and workflow as your SAST findings
- Semantic analysis catches secrets assembled from parts
- Paid only
- Limited value if you are not already using Semgrep
- No live-app or history focus
Aikido Security
Best for: Startups that want secrets, SAST, dependencies and cloud in one dashboard. Free: Free tier for small teams.
- One place for many scan types
- Auto-triage reduces noise
- Fast setup
- Wraps open-source engines for secrets
- Breadth over depth
- Less control over detection rules
How we evaluated
Where each tool looks (history, working tree, the deployed app), whether it can tell a live key from a placeholder, what you can use without paying, and what it does after the finding. Claims about other tools are from their public documentation as of September 2026; tell us if something is out of date. Our own numbers on how often secrets leak come from scanning 2,148 AI-built repos and probing 4,740 live apps.
Frequently asked questions
What is the best secret scanning tool?
For scanning git history, gitleaks if you want free and fast, TruffleHog if you want to know which keys are live, GitGuardian if you need organisation-wide monitoring and incident workflow. GitHub's built-in scanning should be on regardless. For finding the key in your code and in the JavaScript you already deployed, and getting it fixed, Prbl. Most people need two: one for history, one for what is shipping now.
Which secret scanners are free?
gitleaks, TruffleHog's CLI and detect-secrets are open source. GitHub secret scanning is free on public repos. GitGuardian and Aikido have free tiers. Prbl's scan is free with no account and its GitHub Action is free on any repo.
Why do I need a secret scanner if I use environment variables?
Because the secret leaks anyway. It gets committed in a .env file. It gets moved into a NEXT_PUBLIC_ or VITE_ variable, which ships to the browser. It gets a fallback like process.env.SECRET || 'dev-secret'. AI coding tools do all three; a hardcoded credential was the top serious finding across 2,148 AI-built repos we scanned. A scanner that understands those patterns, not just regexes for key formats, is the difference.
Do secret scanners have a lot of false positives?
Regex-only scanners do: test fixtures, example keys in docs, and high-entropy strings that are not secrets. Tools with validity checks (TruffleHog, GitGuardian, Semgrep Secrets) reduce it by testing the key. Prbl reduces it differently: its exclusions come from manually reviewing what the rules flagged on real AI-built repos, and keys that are public by design are classified as such instead of reported as leaks.
I found a leaked key. What is the order of operations?
Rotate first, always; assume it has been read. Then remove it from the code and move it to a server-side environment variable. Then, if it was committed, decide whether to rewrite history; that hides it from casual browsing but does not un-leak it, so rotation is what actually makes you safe. Prbl links the specific fix from each finding.
See whether a key is sitting in your repo or your deployed app right now. Free, no account, about a minute.
Scan for secrets →Related: best SAST tools · best website vulnerability scanners · find hardcoded secrets in a codebase · remove a secret from git history