detect-secrets

detect-secrets is an open-source Python tool for finding secrets in code and helping keep new ones out of a repository. It checks code changes with heuristic regular expressions and also uses entropy and keyword detection. A scan can create or update a baseline of potential secrets already present, while the hook command flags new findings and the audit command lets analysts label baseline entries as true or false positives and compare results. The project recommends running it as a pre-commit hook through the pre-commit framework. Users can adjust built-in plugins and filters, write custom detectors, and manage false positives with exclusions or inline allowlist comments. It can also be imported into Python scripts to scan files and serialize findings. Installation is documented through pip or Homebrew, and the repository lists the Apache-2.0 license. Word-list filtering and the gibberish detector require optional packages; the gibberish detector is off by default. The project cautions that the heuristic hook does not catch every secret, including multiline secrets and some default passwords.

detect-secrets offers configurable checks and baseline review for teams seeking to flag secrets during code changes. Its heuristic hook has stated coverage limits, so it should not be treated as catching every secret.

It suits development and security teams that want to check Git code changes for newly introduced secrets. The project describes itself as designed with enterprise clients in mind.

detect-secrets is a free, open-source Python module that checks code for potential secrets, best suited to teams building secret checks into a Git workflow. Its baseline and configurable detectors help make scanning manageable, but its pre-commit hook cannot catch every secret.

Overview

detect-secrets is designed to keep new secrets out of a codebase while giving teams a way to account for findings that already exist. A scan creates or updates a baseline of potential secrets; the hook checks code changes for new matches, and the audit command helps reviewers label baseline findings as true or false positives. That division makes it easier to introduce scanning into an established repository without treating every existing match as a new problem.

Detection uses regular-expression rules, entropy heuristics, and keyword checks. These methods offer useful coverage, but they are heuristics, not a guarantee: the project warns that the pre-commit hook misses some multiline secrets and default passwords. Teams should use it as one development safeguard, not as their only protection against leaked credentials.

Key features

Baseline and audit workflow

The scan command records potential secrets already in the repository, while audit lets analysts review findings, label false positives, and report or compare results. This is valuable when teams need to distinguish inherited issues from newly introduced ones. It also means someone must review ambiguous matches rather than assuming every flag is a confirmed secret.

Configurable detection

Teams can adjust built-in plugins and filters or develop custom detector plugins and filters. Exclusions can target matching lines, files, or secret values, and inline allowlist comments can suppress known exceptions. That flexibility suits repositories with specific patterns, though tuning and exception review add maintenance work.

Pre-commit and Python use

The project recommends configuring the tool as a pre-commit hook through the pre-commit framework. It can also be imported into Python scripts to scan files and serialize findings. Word-list filtering and the gibberish detector require optional packages, and the gibberish detector is off by default, so those capabilities require extra setup.

Pricing

detect-secrets is free and open source under the Apache-2.0 license. The detect-secrets plan costs nothing and is an open-source Python module installable with pip or Homebrew. There is no paid tier or free-trial period to weigh against a subscription; the tradeoff is that teams configure and maintain the workflow themselves.

Platforms

detect-secrets supports Linux, macOS, Windows, and self-hosted use. It supports Git and pre-commit scanning, making it a fit for teams whose code-change checks run in that workflow.

Who it's for

The project describes itself as designed with enterprise clients in mind. Its customizable detectors, filters, and baseline review can suit teams that want control over how potential secrets are identified and triaged. It is less suitable as a sole control for teams that require comprehensive secret prevention, given the stated gaps in its heuristic hook.

Pros and cons

• Pro: Baselines separate existing findings from new matches, helping teams adopt scanning without treating an old backlog as newly introduced.
• Pro: Custom plugins, adjustable filters, and several exclusion methods let teams tune detection to their repositories and manage false positives.
• Con: The pre-commit hook can miss multiline secrets and some default passwords, so it cannot serve as a complete safeguard.
• Con: Optional word-list and gibberish detection require extra packages, and the gibberish detector needs to be enabled.

Alternatives

Compare secrets scanning software if you want to consider tools beyond this focused open-source workflow.

Amazon Deequ is another free, Apache 2.0 open-source library, but it requires Apache Spark and a release matched to the Spark version.

Semgrep Code is worth considering if you want code and supply-chain coverage in a broader offering; its Free Edition includes up to 10 repositories, a maximum of 10 contributors, and 60 AI credits.

Vooda AI is an alternative to consider for self-hosted production use; its listed plan has no seat limits.

Arnica Secrets Security may suit readers seeking a broader security package alongside secrets scanning, with its Free plan including SAST, SCA, IaC, licensing, reputation scans, and SSO.

Augustus is another free, Apache 2.0-licensed open-source option.

DeepSource may fit teams looking for an open-source plan with unlimited public repositories and unlimited team members.

Endor Labs offers a free option for individual developers, with local scans via its AURI MCP server and no account required.

ggshield is another secrets-scanning option; its CLI is open source.

Verdict

Choose detect-secrets if your team wants a free, configurable way to baseline existing Git findings and flag potential new secrets during pre-commit checks. Its audit workflow and extensibility are the main reasons to adopt it; look elsewhere or add other safeguards if missing some multiline secrets and default passwords is unacceptable.