OpenAI confirmed in September 2026 that its own systems have been scanning GitHub for exposed API keys, which is a polite way of saying its agents were reading public repos for secrets before the developers who wrote them noticed. That is only one of many actors doing it. If you push code to GitHub, GitLab, or a self-hosted server, running a secret scanner locally before every commit is the cheapest security investment you can make. These are the best apps for scanning exposed API keys on desktop, whether you are auditing a solo project or setting up a policy for a team.
What to look for in a secret-scanning app
- Real detectors, not just regex. A regex that matches
api_key = "..."is worth almost nothing. Good scanners include per-provider detectors that both recognise and verify a live token. - Git history support. A leaked key that was fixed three commits ago is still leaked. The scanner has to walk the full commit history, not just the current tree.
- Pre-commit integration. Catching the leak on your machine before the push is orders of magnitude cheaper than rotating the token after the fact.
- False-positive control. A scanner that reports 400 findings on a monorepo will get ignored. Look for allowlist support and entropy tuning.
- CI-friendly output. SARIF or JUnit output means the tool plugs into GitHub Actions or GitLab CI without a wrapper.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price/mo | Rating |
|---|---|---|---|---|---|
| TruffleHog | Verified-secret detection with active credentials | Windows, macOS, Linux | Full CLI | Enterprise for org scanning | 4.8 |
| Gitleaks | Fast local scans with a tiny footprint | Windows, macOS, Linux | Full | Free (open source) | 4.7 |
| detect-secrets | Pre-commit hook the Yelp security team already trust | Windows, macOS, Linux | Full | Free (open source) | 4.6 |
| GitGuardian CLI | Managed dashboards on top of local scanning | Windows, macOS, Linux | Solo tier free | Team pricing on request | 4.7 |
| Semgrep | Broad code SAST that includes secret rules | Windows, macOS, Linux | Community free | Team pricing on request | 4.8 |
| Trivy | Everything-scanner for images, IaC, and Git repos | Windows, macOS, Linux | Full | Free (open source) | 4.7 |
| git-secrets | AWS’s own guardrail against committing AWS keys | Windows, macOS, Linux | Full | Free (open source) | 4.4 |
The apps
1. TruffleHog – best for verified-secret detection
TruffleHog goes further than any other scanner on this list because it does not just detect a secret shape; it verifies. Find a token that looks like a Stripe key, and TruffleHog will actually call the Stripe API to check whether the key is still live. That single feature cuts false positives to near zero on a mature codebase and turns any hit into an incident you can actually action.
Where it falls short: Verification means TruffleHog needs outbound network access. In air-gapped CI, you have to fall back to detection-only mode. The verified-detector list is broad but not exhaustive.
Pricing:
- Free: The open-source CLI, unlimited scans.
- Paid: Enterprise tier for org-wide scanning across GitHub, GitLab, and Slack.
Platforms: Windows, macOS, Linux.
Download: trufflesecurity.com — Source (GitHub)
Bottom line: The default if you want to know a token is not just present but still valid.
2. Gitleaks – best fast local scanner
Gitleaks is the go-to open-source scanner for local pre-commit runs. It walks the full git history, applies a well-maintained ruleset, and returns findings in JSON or SARIF. On a mid-size monorepo it finishes in a few seconds; on a laptop with a slow disk, a few tens of seconds. The default rules cover AWS, GCP, Slack, Stripe, and about 80 other providers.
Where it falls short: No live verification. A finding might be a real secret or a test fixture; you decide.
Pricing:
- Free: Everything.
- Paid: None.
Platforms: Windows, macOS, Linux.
Download: gitleaks.io — Source (GitHub)
Bottom line: The scanner most engineers install first.
3. detect-secrets – best pre-commit hook
detect-secrets was written by Yelp’s security team specifically for the “commit-time” moment. Install it as a pre-commit hook, run detect-secrets scan --baseline .secrets.baseline once to record the currently-known findings, and every future commit is checked against that baseline. New secrets fail the hook; old ones stay flagged for review without blocking the flow.
Where it falls short: Detector count is smaller than TruffleHog. The baseline model is powerful but takes a session to internalise.
Pricing:
- Free: Everything.
- Paid: None.
Platforms: Windows, macOS, Linux (Python-based).
Download: github.com/Yelp/detect-secrets
Bottom line: The right pick for a team standardising on pre-commit.
4. GitGuardian CLI (ggshield) – best for managed dashboards
GitGuardian CLI is the developer-facing side of GitGuardian’s SaaS platform. The CLI scans local repos and pre-commit hooks; the SaaS side monitors your public GitHub org for leaks in real time. If a former employee accidentally forks a private repo, GitGuardian’s public-scan side is what catches it before an attacker does.
Where it falls short: The value is in the SaaS platform. On its own, the CLI is not appreciably better than Gitleaks. Free tier is solo-only.
Pricing:
- Free: Solo developer.
- Paid: Team pricing on request.
Platforms: Windows, macOS, Linux.
Download: gitguardian.com/ggshield — Source (GitHub)
Bottom line: Buy the SaaS if you already need the dashboard; skip the CLI otherwise.
5. Semgrep – best when you want SAST too
Semgrep is a static-analysis scanner with an active secret-rules pack alongside its main SAST library. If you already run Semgrep for code quality or supply-chain checks, adding the secrets pack costs almost nothing. Rules are written in a lightweight, readable DSL that developers actually maintain.
Where it falls short: Not the fastest secret-only scanner. Fine on a five-service monorepo; slower than Gitleaks on gigabyte repos.
Pricing:
- Free: Community rules and the CLI.
- Paid: Team plans for hosted results and Pro rulesets.
Platforms: Windows, macOS, Linux.
Download: semgrep.dev — Source (GitHub)
Bottom line: Pick this if you want secret scanning as part of a broader static-analysis pipeline.
6. Trivy – best all-in-one scanner
Trivy started as a container-image vulnerability scanner and grew a secrets module along the way. If you run one tool across container images, Terraform, Kubernetes manifests, and Git repos, Trivy is the obvious choice. The secret ruleset overlaps heavily with Gitleaks but the same binary scans your Docker images for exposed AWS keys, too.
Where it falls short: Not the sharpest tool for repo-only scanning. Trivy shines when your threat model spans containers and infrastructure-as-code.
Pricing:
- Free: Everything.
- Paid: None.
Platforms: Windows, macOS, Linux.
Download: aquasecurity.github.io/trivy — Source (GitHub)
Bottom line: The right pick when your CI already scans images.
7. git-secrets – best AWS-only guardrail
git-secrets is the utility Amazon maintains to keep AWS access keys and secret keys out of Git. It installs as a Git hook and refuses to accept a commit that matches the AWS key shape. Small, opinionated, and one-purpose.
Where it falls short: AWS-focused by default. You can add custom patterns but at that point Gitleaks does the same thing more comprehensively.
Pricing:
- Free: Everything.
- Paid: None.
Platforms: Windows, macOS, Linux.
Download: github.com/awslabs/git-secrets
Bottom line: The right pick only if your codebase touches AWS and nothing else.
How to pick the right one
If you want one tool and one command that catches secrets you can act on immediately, use TruffleHog. Verified detection makes the reports trustworthy.
If you want the fastest local pre-commit experience and are comfortable filtering false positives by hand, use Gitleaks.
If you are rolling out a team-wide policy with pre-commit hooks, standardise on detect-secrets. The baseline model handles legacy findings without breaking existing repos.
If you need a managed dashboard that watches your public GitHub org for accidental leaks, buy GitGuardian.
If you already run Semgrep or Trivy in CI, just add their secret rules. There is no reason to install a second scanner.
Use git-secrets only in AWS-heavy monorepos where nothing else fits.
FAQ
Which secret scanner has the fewest false positives? TruffleHog, thanks to its verified-detector model. If a finding is reported as verified, the key is currently live at the corresponding provider.
Can I run these scanners on a private repo without exposing the code? Yes. Every tool on this list runs locally. The scanned code never leaves your machine unless you send findings to a managed service on purpose.
Are these scanners a replacement for GitHub’s built-in secret scanning? They are complementary. GitHub scans on push; a pre-commit scanner catches leaks before they hit GitHub at all.
How do I get rid of a secret that was already committed?
Rotate the credential immediately (that is the only real fix), then rewrite history with git filter-repo or the BFG Repo-Cleaner to remove the file, and force-push. Anyone who cloned the repo in the meantime already has it, so rotation is mandatory.
Do secret scanners understand encrypted files or .env.enc? No. Anything opaque to the scanner (SOPS-encrypted YAML, GPG-encrypted env files, sealed-secrets) is skipped. That is the correct behaviour: the scanner only alerts on plaintext credentials.
