Deepfence SecretScanner
Deepfence SecretScanner is a free, open-source Linux and self-hosted tool for locating unprotected secrets in container images and file systems.
What Deepfence SecretScanner is
Deepfence SecretScanner is a free, open-source Linux and self-hosted tool for locating unprotected secrets in container images and file systems. It checks container or host file systems against a database covering approximately 140 secret types, including passwords, AWS access IDs and secret access keys, Google OAuth keys, API keys, encryption keys, SSH keys, and tokens. Scans can target container images or local host directories, with findings written to a JSON file for review. The project suggests using results to decide whether possible secrets should be removed from production deployments. A Docker build command and Quay image pull command are provided, and the quick start requires Docker for container-image scanning. SecretScanner is also included in ThreatMapper. The repository uses an MIT license, directs bugs to GitHub issues, and offers Deepfence Community Slack for help. Use is intended for infrastructure you own.
Good
- Free and open source
- Covers approximately 140 secret types
- Scans images and host directories
- Outputs findings as JSON
- Linux and self-hosted deployment
Watch out
- Requires Docker for container-image scanning
- Self-hosted platform only
- Findings require review for removal decisions
Who it suits
It suits teams needing a free, self-hosted Linux scanner for possible secrets in images or file systems. Docker is required for the documented container-image quick start.
Verdict
SecretScanner focuses on detecting exposed secrets across container and host filesystems, with broad named coverage and JSON output. Its free, self-hosted model fits organizations comfortable operating Docker-based scanning infrastructure.
Plans and prices
From Deepfence SecretScanner's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| SecretScanner | Free | Standalone tool · approximately 140 secret types |
The facts
Each one read from Deepfence SecretScanner's own pages, with the date it was checked.
What it does
- Detection coverage
- It searches container and host file systems against a database of approximately 140 secret types.checked 4 Oct 2026
- Download
- The README provides a Docker build command and a command to pull the SecretScanner image from Quay.checked 4 Oct 2026
- Intended use
- The README says to use the tool only for legitimate detection of secrets on infrastructure you own.checked 4 Oct 2026
- License
- The repository identifies an MIT license.checked 4 Oct 2026
- Output
- It scans container images or local host directories and outputs a JSON file with details of secrets found.checked 4 Oct 2026
- Purpose
- SecretScanner finds unprotected secrets in container images and file systems.checked 4 Oct 2026
- Related product
- SecretScanner is also included in ThreatMapper, which identifies vulnerable dependencies and unprotected secrets in cloud native applications and ranks vulnerabilities by risk of exploit.checked 4 Oct 2026
- Runtime requirement
- The quick start instructs users to install Docker to scan a container image.checked 4 Oct 2026
- Secret examples
- The project names passwords, AWS access IDs and secret access keys, Google OAuth keys, API keys, encryption keys, SSH keys, and tokens as examples of secrets.checked 4 Oct 2026
- Security contact
- The security policy asks users to report security issues confidentially to [email protected].checked 4 Oct 2026
- Suggested users
- The project describes it as a lightweight way to scan images and file systems for possible secrets and review whether they should be removed from production deployments.checked 4 Oct 2026
- Support
- The README directs users to GitHub issues for bugs or feature requests and to the Deepfence Community Slack for help.checked 4 Oct 2026
Alternatives to Deepfence SecretScanner
- 1
DeepSource
Free planWebAPILinuxmacOS8.0From $30 a month - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Vooda AI
Free planWebAPILinuxmacOS6.9Free plan - 4
Arnica Secrets Security
Free planWebAPISelf-hosted6.6From $300 a year - 5
GitGuardian
Free planWebAPILinuxmacOS6.6Free plan - 6
detect-secrets
Free planLinuxmacOSSelf-hostedWindows6.5Free plan