- Home
- Secrets Scanning Software
- Talisman
Talisman
What it is
Talisman is a free, open-source Git tool from ThoughtWorks that checks outgoing changes for possible secrets before they leave a developer’s workstation. It runs on Linux, macOS, and Windows, and can operate as a pre-commit hook, pre-push hook, or standalone executable. Installation options include a global Git hook template, a one-repository hook, and a command-line utility. Detectors inspect encoded values, file contents, file sizes, high-entropy data, possible credit-card numbers, and filenames or extensions. When a check finds a concern, Talisman reports the affected file and errors. Its CLI can scan Git history for secrets already checked in and save report files. A `.talismanrc` file supports ignored files, allowed patterns, custom search patterns, and detector severity settings. Documentation describes use with the pre-commit framework and Husky, plus CI/CD scanning. Talisman is MIT licensed. It cannot detect secrets introduced through a forced push, and interactive ignore-file configuration is limited to non-Windows users.
For and against
For
- Free MIT-licensed project
- Pre-commit and pre-push hooks
- Scans Git history
- Configurable detection rules
- Supports CI/CD scanning
Against
- Cannot detect forced-push secrets
- Interactive ignore mode excludes Windows
- Supports Git only
The verdict
Talisman offers configurable secret checks across Git hooks, history, and CI/CD on three desktop platforms. Forced pushes and the Windows interactive-mode restriction remain notable limits.
Who it suits
It suits developers and teams using Git who want workstation hooks, repository-history scans, and configurable secret detectors. Cross-platform users can run it on Linux, macOS, or Windows.
Plans and prices
Talisman
MIT licensed · pre-commit/pre-push hooks · repository scanning
Read 4 Oct 2026 · thoughtworks.github.io
On the record
- Configuration
- A .talismanrc file supports ignored files, allowed patterns, custom search patterns, and detector severity settings.github.com · read 4 Oct 2026
- Detection checks
- Documented detectors check encoded values, file contents, file size, entropy, possible credit card numbers, and filenames or extensions.github.com · read 4 Oct 2026
- History scanning
- Talisman can scan repository history to detect secrets that have already been checked in.thoughtworks.github.io · read 4 Oct 2026
- Hook modes
- Talisman can be configured as a pre-commit or pre-push Git hook.thoughtworks.github.io · read 4 Oct 2026
- Hook options
- Talisman can run as a pre-commit or pre-push hook, or as a standalone executable.github.com · read 4 Oct 2026
- Install options
- Installation options include a global Git hook template and CLI utility, a hook for one repository, or a standalone executable.github.com · read 4 Oct 2026
- Integrations
- The documentation describes using Talisman with the pre-commit framework and Husky.github.com · read 4 Oct 2026
- Interactive mode limitation
- Interactive mode for adding files to the ignore configuration is documented as available only to non-Windows users.github.com · read 4 Oct 2026
- Known limitation
- Talisman’s installation documentation says it cannot detect secrets introduced through a forced push.thoughtworks.github.io · read 4 Oct 2026
- License
- The documentation says Talisman is distributed under the MIT license.thoughtworks.github.io · read 4 Oct 2026
- Notable limitation
- Talisman’s documentation says it cannot detect secrets introduced through a forced push.github.com · read 4 Oct 2026
- Platform support
- The documentation lists support for macOS, Linux, and Windows.thoughtworks.github.io · read 4 Oct 2026
- Project origin
- The documentation identifies Talisman as an open-source project created by ThoughtWorks.thoughtworks.github.io · read 4 Oct 2026
- Purpose
- Talisman installs Git hooks that check outgoing changes for potential secrets before they leave a developer’s workstation.thoughtworks.github.io · read 4 Oct 2026
- Reporting
- When checks detect a potential issue, Talisman displays a report describing the affected file and errors.github.com · read 4 Oct 2026
- Repository scanning
- The CLI can scan Git history for potential secrets and save report files.github.com · read 4 Oct 2026
- Secret detection
- Its detectors check encoded values, file contents, file sizes, high-entropy content, possible credit card numbers, and filenames.github.com · read 4 Oct 2026
- Support and contributions
- The project directs users to GitHub issues for problems or ideas and invites contributions through its contribution guidelines.thoughtworks.github.io · read 4 Oct 2026
