Betterleaks

Free plan APILinuxMacSelf-hostedWindows

What Betterleaks is

Betterleaks is a free, MIT-licensed tool that scans for leaked secrets such as API keys and credentials. It can inspect files, Git repositories, URLs, piped input, and sources including GitHub, GitLab, Hugging Face, and S3. Its configurable detection and filtering engine uses context to reduce false positives, and custom rules can define detection, validation, and analysis behavior. Scans find secrets without making requests to credential providers by default. Validation can be enabled to check whether detected credentials are active through asynchronous HTTP requests defined in rules; valid findings can then gain identity, account, capability, and severity details. Betterleaks can prioritize findings using confidence, validation status, and analyzed severity. It supports Git, GitHub, and GitLab, as well as CI/CD, pre-commit, and pull-request scanning. Users can install it through Homebrew, Fedora's package manager, Docker, Go, or a source build, or embed it as a Go library. It is intended for developer workflows, CI pipelines, security products, and AI agents. Rules may support credential revocation, but scans do not run revocation.

Who it suits

Betterleaks may suit developers and teams scanning code or repositories in local workflows, CI pipelines, pre-commit checks, and pull requests. It can also be embedded in Go applications or used in security products and AI agents.

What it does well

Scans files, repositories, URLs, and piped input
Supports GitHub, GitLab, Hugging Face, and S3
Custom rules for detection, validation, and analysis
Supports CI/CD, pre-commit, and pull-request scanning
Free and MIT licensed

What to know first

Credential validation is disabled by default
Scans do not run credential revocation

Limits

Credential validation and analysis require explicit enabling, and scans do not execute revocation even when rules support it.

Getting started

Open https://betterleaks.com/
Install with Homebrew, Fedora’s package manager, Docker, Go, or a source build
Run it against local files, Git repositories, URLs, or piped input
Configure contextual detection, validation, or analysis rules as needed
Embed it as a Go library when integrating it into another product

Verdict

Betterleaks offers configurable secret detection, with validation and analysis available when enabled. Its default scans avoid credential-provider requests, and revocation is not performed by scans.

Questions

Is Betterleaks free?

Yes. It has a free plan and is MIT licensed.

Which platforms does it support?

It supports Linux, macOS, and Windows, plus API and self-hosted use.

What can it scan?

It scans files, Git repositories, URLs, piped input, GitHub, GitLab, Hugging Face, and S3.

Does it validate credentials?

Yes, when enabled. Rules can make asynchronous HTTP requests to check whether detected credentials are active.

Can it run in development workflows?

Yes. It supports CI/CD, pre-commit, and pull-request scanning, and is intended for developer workflows, security products, and AI agents.

Facts from Betterleaks's own pages

Analysis: It can enrich valid credentials with identity, account, capability, and severity information. · github.com, 3 Oct 2026
Credential analysis: Betterleaks can enrich valid credentials with identity, account, capability, and severity information. · github.com, 4 Oct 2026
Custom rules: Users can define contextual filtering, validation, and analysis logic in the configuration. · github.com, 4 Oct 2026
Default network behavior: Scans detect secrets without making credential-provider requests by default; validation and analysis can be enabled. · github.com, 4 Oct 2026
Detection: Its detection and filtering engine goes beyond regular expressions and entropy to reduce false positives, analyze findings in context, and validate whether exposed credentials are still live. · betterleaks.com, 4 Oct 2026
Distribution: The project provides Homebrew, Fedora, Docker, Go installation, and source build options. · github.com, 3 Oct 2026
Embedding: Betterleaks can be embedded as a Go library. · github.com, 3 Oct 2026
Install options: The project documents installation through Homebrew, Fedora's package manager, Docker, Go, or building from source. · github.com, 4 Oct 2026
Integrations: The project names Aikido Security and MegaLinter among organizations and projects that use Betterleaks; MegaLinter ships it out of the box. · github.com, 4 Oct 2026
Intended users: The project describes use in developer workflows, CI pipelines, security products, and AI agents. · betterleaks.com, 3 Oct 2026
License: Betterleaks is MIT licensed. · betterleaks.com, 4 Oct 2026
Local use: The documented commands scan local filesystems and Git repositories, as well as remote sources. · github.com, 4 Oct 2026
Other inputs: It can scan files, Git repositories, URLs, and piped input. · github.com, 3 Oct 2026
Pricing: The opened maker pages do not state a paid plan or subscription price. · betterleaks.com, 4 Oct 2026
Prioritization: The project lists prioritization by confidence, validation status, and analyzed severity scores as a feature. · github.com, 4 Oct 2026
Purpose: Betterleaks is a configurable secrets scanner designed to find exposed credentials in repositories, CI artifacts, issue trackers, datasets, logs, and other sources. · betterleaks.com, 4 Oct 2026
Revocation: Rules can optionally revoke credentials, and scans do not run revocation. · github.com, 4 Oct 2026
SDK: Betterleaks can be embedded as a Go library. · github.com, 4 Oct 2026
Security limit: Credential validation is disabled by default and requires enabling it. · github.com, 3 Oct 2026
Sources: The project lists GitHub, GitLab, Hugging Face, and S3 among its supported sources. · github.com, 4 Oct 2026
Validation: It can check whether detected credentials are active through asynchronous HTTP requests defined in rules. · github.com, 3 Oct 2026

Where Betterleaks stands on Freedom251

Secrets Scanning Software#6 of 24