TiloBox
Back to directory
detect-secrets project preview
Developer ToolsAlternative to Snyk SecretsAlternative to TruffleHogAlternative to GitGuardian

detect-secrets

An enterprise tool for detecting secrets and API keys within codebases with baseline audits.

View on GitHub
LicenseApache-2.0
GitHub stars3.5k
Last commit1 weeks ago
Tags5 topics
Entropy Key DetectorPrecommit Secret CheckSecret Scanner BaselineDetect Secrets YelpSecurity
Overview

Why consider detect-secrets?

detect-secrets is an open-source secret scanning framework written in Python by Yelp. detect-secrets uses heuristic entropy algorithms and regex plugins to flag API tokens, private keys, and passwords before commit, maintaining a project baseline file to prevent false positives.

Guided learning

Learn detect-secrets by building

Practical setup notes, real use cases, and copy-ready examples in one focused guide.

1 min read 2 sections
In this guide2 sections

Overview of detect-secrets

detect-secrets audits codebases for committed private keys, JWT tokens, and database passwords.

Quickstart

bash
1pip install detect-secrets
2detect-secrets scan > .secrets.baseline
3detect-secrets audit .secrets.baseline

detect-secrets is licensed under the Apache License Version 2.0.

Related tools

More options with a similar category or technology profile.

diskus logo

diskus

Minimal, fast alternative to du -sh written in Rust using multi-threaded directory traversal.

peco logo

peco

Simplistic interactive filtering tool for Unix pipelines, process lists, and file trees.

Dapr CLI logo

Dapr CLI

Command-line tool for managing Dapr distributed application runtime environments and sidecars.

Freeze logo

Freeze

Generate beautiful image screenshots and SVGs of code snippets and terminal outputs.

detect-secrets FAQs

detect-secrets is listed as a Developer Tools tool on TiloBox. Review the overview, features, and official documentation on this page to decide whether it solves your specific workflow.

Start with the project's GitHub repository for supported installation and deployment instructions. Test the setup with representative data or a small project before rolling it out more widely.

detect-secrets is listed under the Apache-2.0 license. Read the complete license text and the project's notices before using, modifying, or distributing the software.

Production readiness depends on your requirements. Review maintenance activity, security practices, documentation, backup and upgrade procedures, and compatibility with your stack; then validate it in a non-production environment.

detect-secrets is listed as an alternative to Snyk Secrets. Compare the core workflow, deployment model, integrations, and licensing against your must-have requirements before switching.