Recommended Free Tools
Short answer: The PyPI-listed dotguard-scan is described as a lightweight way to find environment-variable references in project files and keep .env.example documentation aligned. TruffleHog is built for broader secret discovery across repositories and other data sources, with API verification for supported credential types. A small development team focused on configuration drift may find the first workflow relevant; a data or security team responsible for many sources may need the second. That is a workflow-based distinction, not a head-to-head performance finding.
What each tool is documented to do
| Question | dotguard-scan |
TruffleHog |
|---|---|---|
| Primary task | Find environment-variable references and help keep .env.example aligned with the codebase. PyPI package listing |
Discover potential credentials across Git and other documented sources, with verification against issuing services for supported detector types. Project README |
| What a finding means | A variable name or reference matched the tool’s documented parsing or naming patterns. This does not establish that a value is present or that a credential works. PyPI package listing | Findings can have different statuses, including verified, unknown, and unverified. A verified finding means the issuing service confirmed the credential as live, according to the project documentation. Project README |
| Typical scope | A project directory and its environment-variable documentation. | Git providers, local files, cloud storage, container images, CI systems, and some collaboration or workspace services; exact support depends on the installed release. Project README |
| Best first question | Are variables used in code missing from our example configuration or drifting between environment files? | Which repositories, histories, clouds, images, and other sources could contain credentials, and who will validate and remediate findings? |
When an environment-documentation check is the useful fit
The PyPI listing describes dotguard-scan as a project-level environment-variable inventory and documentation helper. Its examples include scanning the current directory or a specified folder, generating or customizing output, checking whether variables are documented, comparing .env with .env.example, and auditing variable use. The package description is not limited to Node.js: its listed parsing examples include Python references such as os.getenv and os.environ, JavaScript’s process.env.KEY, shell variables, and generic getenv. PyPI package listing
As an Amazon Associate I earn from qualifying purchases.
That makes this kind of tool relevant when a team’s recurring problem is configuration drift: a developer adds a variable in code, but the example file or setup notes do not get updated. Pattern matching for names such as _KEY, _SECRET, _PASSWORD, or _TOKEN can help surface likely sensitive variables, but it is not credential validation. A matching name is not proof that a secret value exists, is exposed, or can be used.
Identity matters here. The available package page is for dotguard-scan. A separate June 2026 launch post uses the name “dotguard” and links to a repository, but the available evidence does not establish that repository and the PyPI package are the same project. Do not assume the package’s commands, license, or current status apply to that separate repository. June 2026 launch post
#1 Best Overall
When broader secret discovery is needed
TruffleHog’s documented scope goes beyond keeping a single project’s environment example file current. Its README describes scanning Git repositories and sources such as local files, S3 and GCS, Docker images, CI systems, and services including GitHub and GitLab; it also documents workflows involving tools and platforms such as Postman, Jenkins, Elasticsearch, and Hugging Face. The supported sources, flags, and authentication requirements are release-sensitive, so check the documentation for the version you install. Project README
Its result statuses matter. A candidate finding is not automatically a confirmed working credential: TruffleHog distinguishes verified, unknown, and unverified results. For supported credential types, verification contacts the issuing service to check whether the credential is live. Verification can therefore give responders a more actionable signal, but it is not universal across every possible secret type or source. Project README
Rank #2
The README documents text, JSON, and SARIF output, plus CI and pre-commit examples. Operational details can affect rollout: the project says SARIF output buffers the full result set in memory, and its FAQ notes that unauthenticated GitHub scans encounter rate limits and recommends a token to improve them. Its option for discovering cross-fork object references and deleted commits is described as alpha, not as a mature default scanning mode. Check the installed release’s documentation before relying on any of these options. Project README
How to choose for a small development shop or a data team
For a small Node-focused shop
- If the immediate pain is incomplete
.env.examplefiles or mismatches between environment files and code references, start with the documenteddotguard-scanworkflow and confirm that its current package and commands meet your needs. PyPI package listing - If the risk includes credentials committed to Git history, a project-level variable inventory is not a substitute for repository secret scanning. Decide whether GitHub’s built-in scanning or a broader scanner covers the repositories and content you need.
- Assign ownership for alerts before adding a check to CI: someone must determine whether a finding is sensitive, update configuration documentation where appropriate, and route any real leak to the credential owner.
For a data or security team
- List the sources in scope—not just source-code repositories—including cloud storage, container images, CI systems, and collaboration services. Then confirm the installed TruffleHog release supports those sources and the authentication model you can provide. Project README
- Decide how verified, unknown, and unverified findings will be triaged, and who can rotate or revoke each credential. Verification is useful for prioritization, but it does not replace incident response.
- Choose an output and integration path that responders can use. The README documents text, JSON, and SARIF output, along with CI and pre-commit examples; consider its stated SARIF memory behavior and GitHub rate-limit guidance when designing a large scan. Project README
This audience distinction follows from the tools’ documented jobs; it is not a measured segmentation, accuracy comparison, or recommendation that one product replaces the other.
Rank #3
Consider GitHub secret scanning if your repositories are on GitHub
GitHub Secret Scanning is a relevant overlapping option for GitHub-hosted work. GitHub says it scans all Git history on all branches and can also cover issue, pull-request, discussion, wiki, and secret-gist content. Availability varies by repository type: public repositories receive secret scanning automatically for free; organization-owned private or internal repositories require GitHub Secret Protection on eligible Team or Enterprise Cloud plans, while user-owned repositories have additional rules. Pattern capabilities and availability also vary by plan. About secret scanning Supported secret-scanning patterns
Detection, validity checking, and partner reporting are separate behaviors. GitHub documents validity checks that may contact an issuing service to determine whether a credential has been revoked; it does not say every detection is checked live. GitHub may also notify a participating provider when it detects a partner secret, but that does not mean every alert triggers provider action or credential revocation. About secret scanning Supported secret-scanning patterns
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when a real credential is found
- Rotate or revoke it promptly. GitHub advises rotating an affected credential immediately to prevent unauthorized access. Remediating a leaked secret
- Assess exposure and access. Follow the issuing provider’s incident process, including reviewing relevant access logs and determining what the credential could reach.
- Remove the value from active use and update dependent systems. Coordinate the change with services, deployments, and owners that rely on the credential.
- Consider history cleanup based on policy and incident needs. GitHub notes that removing a secret from Git history can be time-intensive and is often unnecessary after revocation, though repository policy or incident requirements may still call for cleanup. Remediating a leaked secret
A scanner reports or detects; it does not perform rotation, containment, or incident response on the team’s behalf.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
