Code and secret leaks

Has anyone committed credentials or keys to code?

Secret scanners search repositories and their full history for API keys, tokens and passwords. Point them at your own organisation's code. A secret removed in a later commit is still exposed.

Listed alphabetically. The order is not a ranking.

• GitleaksPassive

  Regex-based secrets scanner for auditing your own git history, directories and piped input, with pre-commit and CI support.

  31k stars · last push October 28, 2026 · v8.30.1 · MIT

• TruffleHogPassive and active modes

  Secrets scanner for auditing your own repositories, buckets and images, with checks that confirm whether a found credential is still live.

  29k stars · last push November 10, 2026 · v3.99.8 · AGPL-3.0