A leaked credential is not a code bug you fix in the next release. Deleting the line does nothing, because the key lives on in git history and every clone. The only fix is revoking it, and you can only revoke what a scanner found.
GitGuardian's State of Secrets Sprawl 2026 report, published March 17, 2026, counted 28.65 million new hardcoded secrets in public GitHub commits during 2025, a 34% increase over 2024. The same report found that 64% of credentials confirmed valid in 2022 were still valid when retested in January 2026. So I planted ten fake credentials in a test repository, one of them deleted after commit, and ran the four open-source scanners worth using against it.
What Teams Actually Run
As of September 24, 2026, Gitleaks has 29,466 GitHub stars and TruffleHog has 28,039. In a March 12, 2026 post, Gitleaks author Zach Rice put Gitleaks at 26 million GitHub downloads, 1.2 million Homebrew installs and 35 million Docker and GHCR pulls.
Praetorian archived Nosey Parker, whose last release was v0.24.0 on May 8, 2025. Yelp's detect-secrets hasn't shipped since v1.5.0 in May 2024. And Rice, who says he no longer has full control of the Gitleaks repo and name, started Betterleaks in February 2026 with backing from Aikido Security.
In the same report, commits co-written with Claude Code leaked secrets at a 3.2% rate, against a 1.5% baseline across all public commits. MCP configuration files exposed 24,008 unique secrets, 2,117 of them valid. Internal repositories were roughly 6 times likelier than public ones to hold hardcoded secrets.
The Benchmark: Ten Planted Secrets, Four Scanners
Each scanner ran in full-history git mode with live validation off. The four-commit test repository holds an AWS key pair, a Postgres connection string, a Slack webhook and a SendGrid key in source files; a Stripe live key and a GitHub token in a .env; and an RSA private key in a .pem. Commit three deletes the .env and the key file. Commit four adds a .mcp.json with inline OpenAI and Anthropic keys, plus decoys: lockfile hashes, a UUID, a SHA-1, AWS's documented AKIAIOSFODNN7EXAMPLE and a your-api-key-here placeholder. The GitHub token carries a valid CRC32 checksum.
Bashgitleaks git ./repo -f json -r out/gitleaks.json --no-banner betterleaks git ./repo -f json -r out/betterleaks.json trufflehog git file://./repo --json --no-update --no-verification > out/trufflehog.json kingfisher scan ./repo --no-validate -f json -o out/kingfisher.json
Five regenerations with fresh random values gave identical results:
textgitleaks findings= 9 seeds found=9/10 noise=0 missed=[postgres] betterleaks findings= 9 seeds found=9/10 noise=0 missed=[awsSecret] trufflehog findings= 9 seeds found=10/10 noise=0 missed=[] kingfisher findings= 9 seeds found=9/10 noise=0 missed=[awsSecret]
Every tool found the secrets that had been deleted in commit three, and none flagged a decoy. Clean fixtures are the easy case, so I also timed the full history of Express (6,425 commits) three times on an Apple M3 Pro. Every flag was a false positive:
| Scanner | Median time | Findings on Express | What it flagged |
|---|---|---|---|
| Betterleaks 1.8.1 | 0.77 s | 5 | Test fixtures, an example login, a package version |
| Kingfisher 2.7.0 | 0.91 s | 0 | - |
| Gitleaks 8.30.1 | 1.08 s | 0 | - |
| TruffleHog 3.97.9 | 2.70 s | 1 | http://tobi:hello@example.com in a code comment |
Gitleaks
Gitleaks is the regex scanner almost everyone starts with. It's one Go binary with 222 rules in its default config. It reads .gitleaks.toml allowlists, and drops into pre-commit or CI in one line.
In the benchmark it made zero noise on Express and was the only tool to flag the AWS secret access key as its own finding, through its generic-api-key rule. It missed the Postgres connection string outright, production password and all.
It doesn't validate, so a human triages every finding. The official GitHub Action needs a free license key for organization accounts. The last release shipped six months ago, and the original author now works on a competitor.
License: MIT · Version: v8.30.1 (March 21, 2026) · Price: free
Betterleaks
Betterleaks is Zach Rice's rebuild of Gitleaks, maintained by the same team and funded by Aikido Security. It's a drop-in replacement: Gitleaks CLI flags and config files carry over.
It ships 463 rules and caught the Postgres URL that Gitleaks missed. It was the fastest on Express and scans GitHub issues, GitLab, Hugging Face and S3 directly. Instead of Shannon entropy it filters candidates by how efficiently a BPE tokenizer compresses them, and the project reports 98.6% recall on the CredData dataset against 70.4% for entropy. That's the author's figure, not an independent test. Validation is opt-in with --validation.
On real code its generic-password rule was the noisiest thing I ran: five findings on Express, every one a test fixture or example. It also skipped the AWS secret key, though it flagged the key ID one line above. It's seven months old, so expect config churn.
License: MIT · Version: v1.8.1 (August 18, 2026) · Price: free
TruffleHog
TruffleHog from Truffle Security was the only scanner to catch all ten secrets. Its detectors pair related values: the AWS key ID and secret come back as one finding, because TruffleHog needs both to test the credential.
Verification is the reason to pick it. TruffleHog classifies more than 800 secret types and logs in to the provider to check whether each credential is live. trufflehog git <repo> --results=verified reports only credentials that work, which turns a long backlog into a revocation list.
It was the slowest scanner here at 2.70 seconds, and its binary is 170 MB. AGPL-3.0 matters if you embed it in a product you distribute. The dashboard, Slack and Jira sources, and continuous monitoring are all in the Enterprise tier, which has no public price.
License: AGPL-3.0 · Version: v3.97.9 (September 24, 2026) · Price: open source free, Enterprise by quote
Kingfisher
Kingfisher is MongoDB's Rust scanner. Version 2 uses the Betterleaks rule catalog as its core and fills gaps with detectors from Google's Veles, which is why its seed results matched Betterleaks exactly.
It goes further after detection. It lists 485 rules, validates live credentials, maps the blast radius (which AWS roles or GCP resources a leaked key can reach) for 43 providers, and can revoke 34 credential types directly. All of it ships in the free Apache 2.0 release. It produced no noise on Express, and its report viewer imports Gitleaks and TruffleHog output too.
It's the youngest project with the smallest community (1,238 stars), and it inherited the same AWS secret key gap as Betterleaks. Blast-radius mapping calls cloud APIs with the leaked credential, so clear that with whoever owns the account first.
License: Apache 2.0 · Version: v2.7.0 (September 24, 2026) · Price: free
GitHub Secret Protection
GitHub Secret Protection is the scanner built into GitHub itself. Since April 1, 2025 it has been sold separately from Advanced Security at $19 per active committer per month, including on the Team plan.
Push protection is the feature that matters: the server rejects the push before the secret ever lands in the repo, so there is no history to clean. GitHub builds provider patterns with AWS, Azure and Google Cloud, and alerts providers when their tokens appear in public code. The paid tier adds validity checks, generic patterns such as connection strings, AI-detected passwords and bypass controls.
It only covers GitHub. Public repos get push protection free, but the generic patterns that catch connection strings are paid only. It isn't benchmarked because it can't scan a local repository.
Pricing: free on public repos · $19/active committer/month on private repos
GitGuardian
GitGuardian is the commercial platform built around this problem. Its ggshield CLI detects more than 500 secret types in pre-commit, pre-push and CI, and the platform extends scanning to Slack, Jira, Confluence and developer laptops.
The free Starter plan covers up to 25 developers with unlimited real-time scanning, against $5,700 a year on GitHub. The paid plans sell workflow: remediation playbooks, Slack and Jira integrations, public GitHub monitoring for your developers' personal repos, and honeytokens.
ggshield sends content to GitGuardian's API for detection, so scans don't run locally, which is why it isn't benchmarked. Starter caps historical scans at 500 detections, and the Growth and Enterprise plans have no public price.
License: ggshield MIT · Version: ggshield v1.55.0 (September 24, 2026) · Pricing: free up to 25 devs · Growth and Enterprise by quote
Side by Side
Prices as of September 24, 2026. Seeds found is out of 10 in the benchmark above.
| Tool | Model | Seeds found | Live validation | Runs locally | License | Price |
|---|---|---|---|---|---|---|
| Gitleaks | CLI | 9 | No | Yes | MIT | Free |
| Betterleaks | CLI | 9 | Opt-in | Yes | MIT | Free |
| TruffleHog | CLI + Enterprise | 10 | Yes, 800+ types | Yes | AGPL-3.0 | Free / quote |
| Kingfisher | CLI | 9 | Yes + blast radius | Yes | Apache 2.0 | Free |
| GitHub Secret Protection | Hosted | Not tested | Paid tier | No | Proprietary | $19/committer/mo |
| GitGuardian | SaaS + CLI | Not tested | Yes | No | ggshield MIT | Free to 25 devs |
How to Choose Without Migrating Twice
- Scan your full history first. Run TruffleHog with
--results=verifiedacross every repo you own. The count it returns tells you whether this is a hygiene project or an incident. - Put a blocker at push time. Leaks that never land in history cost nothing to fix. On GitHub that's push protection. Everywhere else it's a Gitleaks or Betterleaks pre-commit hook, backed by a CI job that can't be skipped.
- Test on your own repos, not the vendor's. Run two scanners on your noisiest repository and count the false positives. The Express result above shows the ranking can flip once real test fixtures show up.
- Price by active committer. At $19 a month, 25 committers on GitHub cost $5,700 a year. GitGuardian's free tier covers the same team, and Semgrep sells Secrets at $15 per contributor per month.
- Decide who owns remediation. A scanner with no workflow produces a JSON file nobody reads. If you want tickets, assignment and audit trails, that's the case for a platform, not a bigger ruleset.
Which One Should You Actually Use?
Already paying for GitHub Team or Enterprise: buy Secret Protection for push protection and validity checks, and run TruffleHog once over history committed before you turned it on.
No budget: use a Betterleaks pre-commit hook, run TruffleHog --results=verified weekly in CI, and allowlist your test fixtures in .betterleaks.toml on day one.
A security team that needs to know what a leaked key can reach: Kingfisher. Blast-radius mapping and direct revocation ship free in the Apache 2.0 binary.
A team under 25 developers that wants dashboards and Slack alerts: GitGuardian's free Starter plan, as long as sending code to its API passes your SOC 2 vendor review.
Settled on Gitleaks with tuned allowlists: keep it, but add a rule for connection strings, and watch whether releases keep coming.
Conclusion
The detection gap between the free scanners has nearly closed: all four CLIs found nine or ten of ten planted secrets, including those in deleted history. The differences now are validation, noise on real code and what happens after a finding. Before you renew a contract, run TruffleHog --results=verified on your own history. The number of live credentials it returns tells you whether your current tool is working.
Related DevToolLab Tools
- Gitignore Tester - confirm
.env,*.pemand.mcp.jsonmatch an ignore rule before the first commit, which is cheaper than any scanner. - Env File Diff Checker - compare
.env.exampleagainst a real.envto spot a value that crept into the file meant for committing. - Kubernetes Secret Decoder - base64 in a Secret manifest is encoding, not encryption; decoding one shows what a leaked YAML file exposed.
- API Key Generator - issue a strong replacement key during rotation, after the scanner has told you which one to revoke.
Related Guides
- Best Secrets Management Tools - where credentials should live once the scanner has pulled them out of your code.
- Developer Security Toolkit - how secrets scanning fits next to SAST and SCA in one CI pipeline.
- Supply Chain Security Tools - SBOMs, dependency scanning and signing, the other half of keeping a repository clean.
- Non-Human Identity Security Guide - governing the service accounts and API keys these scanners keep finding.