No. 15 of 23 ·Secrets Scanning Software

detect-secrets

Windows · Mac · Linux

Freedom report

Two barsScore 5.5

detect-secrets is ranked #15 of 23 in secrets scanning software on Freedom251. It runs on Linux, macOS, Windows.

Compared on secrets scanning software

Purpose: detect-secrets detects secrets in a codebase and aims to prevent new secrets from entering it.
Detection approach: It checks code changes using heuristically crafted regular expressions to identify newly committed secrets.
Baseline: A scan creates a baseline of potential secrets already present in a repository.
Scanning tools: The project provides scan, hook, and audit commands to create baselines, flag new secrets, and review baseline findings.
Detection methods: Its detection strategies include regex rules, entropy detection, and keyword detection.
Customization: Users can develop custom detector plugins and filters, and adjust built-in plugins and filters.
Integrations: The README recommends configuring detect-secrets as a pre-commit hook with the pre-commit framework.
Installation: The project documents installation with pip or Homebrew.
License: The repository identifies its license as Apache-2.0.
False positive handling: Users can exclude matching lines, files, or secret values and can use inline allowlist comments.
Optional extensions: Word-list filtering and the gibberish detector require optional packages; the gibberish detector is not enabled by default.
Limitations: The README says the heuristic pre-commit hook does not prevent all secrets, including multiline secrets and some default passwords.
Intended users: The project describes itself as designed with the enterprise client in mind.

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.