Name: Open-source secrets scanners for repos and CI pipelines
Creator: The Webhound Team
Published: 2026-05-07T19:10:10.298666+00:00
Keywords: A practical inventory of open-source tools for catching leaked credentials in code and build workflows.

Open-source secrets scanners for repos and CI pipelines$3 spent

$2.50 spent

tool_name	scan_scope	license	ci_integration	github_url	last_release_or_commit_signal	docs_url
Whispers	["structured text","source code","configuration files"]	Apache-2.0	true	https://github.com/Skyscanner/whispers	2021-10-18	https://github.com/Skyscanner/whispers
Talisman	—	—	—	https://github.com/thoughtworks/talisman	—	—
Shhgit	["GitHub","Gist","GitLab","BitBucket","local directory"]	MIT	true	https://github.com/eth0izzle/shhgit	2025-02-28	https://github.com/eth0izzle/shhgit
ScoutSuite	—	—	—	https://github.com/nccgroup/ScoutSuite	—	—
Secret-scanner (Grab)	["git history","file names","file content","local repositories"]	MIT	false	https://github.com/grab/secret-scanner	2019-12-19	https://github.com/grab/secret-scanner
Hawkeye	["project files","dependencies","git staged files","CI/CD pipelines"]	Apache-2.0	true	https://github.com/hawkeyesec/hawkeye	2021-08-31	https://github.com/hawkeyesec/scanner-cli
Infisical	—	—	—	https://github.com/infisical/infisical	—	—
Node-sec-scan	N/A	N/A	N/A	https://github.com/nearform/node-sec-scan	N/A	N/A
Prowler	["AWS","Azure","GCP","Kubernetes"]	Apache-2.0	true	https://github.com/prowler-cloud/prowler	2026-05-07	https://docs.prowler.com/
EarlyBird	["local files","directories","remote git repositories","git history","staged files","tracked files","streamed input"]	Apache-2.0	true	https://github.com/americanexpress/earlybird	2026-05-06	https://github.com/americanexpress/earlybird
SecretScanner	["container images","file systems"]	MIT	false	https://github.com/deepfence/SecretScanner	2026-03-07	https://threatmapper.org/docs/secretscanner/
Kingfisher	["git history","local files","GitHub","GitLab","Azure Repos","Bitbucket","Gitea","Hugging Face","Jira","Confluence","Slack","Microsoft Teams","Postman","Docker","AWS S3","Google Cloud Storage","compressed files","SQLite databases","Python bytecode"]	Apache-2.0	true	https://github.com/mongodb/kingfisher	2026-05-05	https://mongodb.github.io/kingfisher/
Git-all-secrets	—	—	—	https://github.com/anshumanbh/git-all-secrets	—	—
Ggshield	["files","repositories","Docker images","PyPI packages","AI coding assistants","CI/CD pipelines","git hooks"]	MIT	true	https://github.com/GitGuardian/ggshield	2026-05-07	https://docs.gitguardian.com/ggshield-docs/getting-started
Detect-secrets	["git repositories","local files","staged files"]	Apache-2.0	true	https://github.com/Yelp/detect-secrets	2026-04-02	https://github.com/Yelp/detect-secrets/tree/master/docs
Salus	["source code","dependencies"]	Apache-2.0	true	https://github.com/coinbase/salus	2023-09-29	https://github.com/coinbase/salus
Trivy	["container images","filesystems","git repositories","virtual machine images","kubernetes"]	Apache-2.0	true	https://github.com/aquasecurity/trivy	2026-05-06	https://trivy.dev/docs/latest/
TruffleHog	["GitHub","GitLab","Docker","filesystems","S3","GCS","Circle CI","Travis CI","Hugging Face","Postman","Jenkins","Elasticsearch","syslog","stdin"]	AGPL-3.0	true	https://github.com/trufflesecurity/trufflehog	2026-05-07	https://docs.trufflesecurity.com
Gitleaks	["git history","files","stdin","archives"]	MIT	true	https://github.com/gitleaks/gitleaks	2026-03-25	https://github.com/gitleaks/gitleaks
LeakLooker	—	—	—	https://github.com/woj-ciech/LeakLooker	—	—
Git-secrets	["git history","commits","commit messages"]	Apache-2.0	false	https://github.com/awslabs/git-secrets	2025-09-17	https://github.com/awslabs/git-secrets
Gitrob	["git history","github repositories"]	MIT	false	https://github.com/michenriksen/gitrob	2018-07-05	https://github.com/michenriksen/gitrob
DumpsterDiver	["git logs","compressed archives","local directories"]	MIT	false	https://github.com/securing/DumpsterDiver	2021-07-16	https://github.com/securing/DumpsterDiver
Checkov	["IaC files","CI/CD pipelines","container images","open source packages"]	Apache-2.0	true	https://github.com/bridgecrewio/checkov	2026-05-07	https://www.checkov.io
Git-hound	["GitHub repositories","Gists","git history"]	MIT	false	https://github.com/tillson/git-hound	2025-11-19	https://github.com/tillson/git-hound
Credential Digger	["git repositories","pull requests","wiki pages","local files and folders","github organizations"]	Apache-2.0	true	https://github.com/SAP/credential-digger	2025-08-04	https://github.com/SAP/credential-digger/wiki
Semgrep	—	—	—	https://github.com/semgrep/semgrep	—	—
Horusec	["git history","project files"]	Apache-2.0	true	https://github.com/ZupIT/horusec	2023-08-07	https://docs.horusec.io/docs/overview/
NoseyParker	—	—	—	https://github.com/praetorian-inc/noseyparker	—	—

Made with Webhound · Ask questions about this research, build on it, or start your own