detect-secrets

detect-secrets is a free Python module for spotting likely secrets in Git repositories and checking code changes before they are committed. It is best suited to teams that want a configurable, self-hosted check in their development workflow. Its baseline and review tools help manage existing findings, but its heuristic hook is not a complete barrier to secret leaks.

Overview

Introducing a scanner to an established codebase can surface old findings alongside new risks. detect-secrets addresses that distinction with a baseline: a scan records potential secrets already present, and later checks flag new matches in code changes. The audit command lets analysts label baseline findings as true or false positives, then report or compare results. This makes the tool more practical for repositories with existing findings, though teams still need to review and maintain the baseline.

Detection combines regular-expression rules, entropy heuristics, and keyword checks. That offers several ways to identify suspicious values, but the approach remains heuristic. The project cautions that the pre-commit hook misses some secrets, including multiline values and some default passwords. It is a useful development check, not a guarantee that secrets will stay out of Git.

Key features

Configurable detection

Teams can adjust built-in detectors and filters or develop custom detector plugins and filters. This flexibility suits organizations with coding conventions or secret formats that generic rules may not match. It also puts responsibility on the team to tune rules and keep them useful; customization does not remove the underlying limits of heuristic detection.

False-positive review

Matching lines, files, or secret values can be excluded, and inline allowlist comments can suppress particular matches. These options help keep recurring benign findings from overwhelming review. They require care: exclusions and allowlists can also hide a real secret if applied too broadly.

Development workflow

The project recommends connecting detect-secrets to the pre-commit framework, so checks run as part of the commit workflow. It can also be imported into Python scripts to scan files and serialize findings. Those options make it adaptable for teams that want either a hook-based check or a scripted workflow, but the documented hook limitations mean it should not be the only control.

Word-list filtering and the gibberish detector are optional extensions that require additional packages; the gibberish detector is not enabled by default. Teams that rely on either should account for the extra installation and configuration rather than assuming it is part of the default scan.

Pricing

detect-secrets is open source under the Apache-2.0 license. Its detect-secrets plan costs free and provides the Python module, installable with pip or Homebrew. There is no paid tier or free-trial period to weigh against the free use described here. This is a straightforward fit for teams comfortable installing and maintaining an open-source tool; it does not come with a published hosted-service plan.

Platforms

detect-secrets supports Linux, macOS, and Windows, and can be self-hosted. It works with Git and supports pre-commit scanning. That makes it relevant to teams standardizing checks around Git repositories across these operating systems, rather than readers seeking a browser-based service.

Who it's for

The project describes itself as designed with the enterprise client in mind. Teams that need to establish a baseline, review findings, and tune detection to their own codebase are the strongest fit, especially when they already use Git and can maintain a pre-commit workflow. Smaller teams can use the same free module, but should weigh the setup and review work against their need for a customizable local check. It is a weaker fit for anyone who needs a guarantee that all secrets will be caught or wants the hook to replace broader security controls.

Pros and cons

• Baseline separates old findings from new matches: teams can introduce scanning without treating every existing potential secret as a newly committed issue.
• Several tuning paths: custom detectors, filters, exclusions, and allowlist comments let teams adapt scanning and manage false positives.
• Free and self-hosted: the Apache-2.0 Python module can be installed with pip or Homebrew, without a paid plan.
• Heuristic coverage has known gaps: the hook may miss multiline secrets and some default passwords, so it cannot serve as the sole safeguard.
• Optional detection extras need separate packages: word-list filtering and the disabled-by-default gibberish detector add installation and configuration work.

Alternatives

For a wider set of options, browse Secrets Scanning Software. Choose Vooda AI instead if you want a freemium option with a self-hosted plan that has no seat limits. Amazon Deequ is a free Apache 2.0 open-source library, but it requires Apache Spark and a release matching the Spark version, making it relevant when that dependency fits your stack. ByteHide Secrets offers a free plan capped at 2,000 secrets for readers who want a defined free allowance.

DeepSource may suit teams looking for an open-source plan with unlimited public repositories and team members, alongside a stated cap of 1,000 pull request reviews. Endor Labs offers individual developers free local scans via its AURI MCP server without an account, but its Developer plan has no UI, policies, or scan history. ggshield is another freemium alternative; its CLI is open source, while the secrets detection library behind GitGuardian’s public API is closed source. GitGuardian is worth considering for a freemium option whose Starter plan covers up to 25 developers and includes unlimited real-time scanning, with historical detection capped at 500.

Semgrep Code is a paid product with a free edition that includes Code and Supply Chain for up to 10 repositories and 10 contributors, so it may fit teams wanting those broader code and supply-chain checks within those caps.

Verdict

Choose detect-secrets if your team wants a free, self-hosted Git check with baselines, audit review, and room to tune detection to its own codebase. Its main advantage is a workflow that distinguishes inherited findings from new matches without requiring a paid plan. Look elsewhere if your priority is comprehensive prevention: the project acknowledges that its heuristic hook misses some secrets, so it belongs as one layer in a security process, not the final line of defense.