Git Secret Scanner
Git Secret Scanner is a free tool for locating hardcoded credentials in GitHub organizations and local filesystems.
What Git Secret Scanner is
Git Secret Scanner is a free tool for locating hardcoded credentials in GitHub organizations and local filesystems. Its detection combines pattern matching, Shannon entropy analysis, context scoring, and denylist filtering to help reduce false positives. Listed patterns cover credentials and tokens associated with AWS, GCP, Azure, GitHub, Slack, Stripe, JWT, SSH and PEM keys, and database URIs. Findings can be exported in JSON, CSV, or SARIF formats. The README describes SARIF compatibility with GitHub Advanced Security, Azure DevOps, GitLab Security Dashboard, and SonarQube, and provides GitHub Actions and GitLab CI examples. Findings may include severity, recommended immediate actions and prevention steps, provider-specific rotation commands, and documentation links. The scanner does not authenticate with or test detected credentials, so matches need manual verification. Findings are masked in logs, and reports containing finding details should be encrypted. Installation requires Python 3.8+ and Git 2.20+; organization scanning also needs a GitHub token and organization name. The MIT-licensed tool is free for personal and commercial use.
Good
- Scans GitHub organizations and local filesystems.
- Exports findings as JSON, CSV, or SARIF.
- Provides remediation details and rotation commands.
- MIT licensed for personal and commercial use.
Watch out
- Matches need manual verification.
- Organization scans require a GitHub token and organization name.
- Requires Python 3.8+ and Git 2.20+.
- Reports with finding details should be encrypted.
Who it suits
It suits security, DevOps/SRE, development, and compliance teams looking for credential scanning in GitHub organizations or local filesystems. Teams using GitHub Actions or GitLab CI can refer to the provided examples.
Verdict
Git Secret Scanner combines broad credential patterns with contextual checks and export options. Treat matches as leads to verify, and protect reports that contain finding details.
Plans and prices
From Git Secret Scanner's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Git Secret Scanner | Free | MIT licensed · free for commercial and personal use |
The facts
Each one read from Git Secret Scanner's own pages, with the date it was checked.
What it does
- Coverage
- It lists patterns for credentials and tokens including AWS, GCP, Azure, GitHub, Slack, Stripe, JWT, SSH/PEM keys, and database URIs.checked 5 Oct 2026
- Detection
- The README describes pattern matching, Shannon entropy analysis, context scoring, and denylist filtering to reduce false positives.checked 5 Oct 2026
- Integrations
- The README provides GitHub Actions and GitLab CI examples and documents SARIF upload to GitHub Advanced Security.checked 5 Oct 2026
- License
- The repository states that the tool is MIT licensed and may be used and modified for personal or commercial projects.checked 5 Oct 2026
- Limits
- The documented defaults include a 10 MB maximum file size, local scan depth of 10, and concurrency of 5 repositories and 50 files.checked 5 Oct 2026
- Purpose
- Git Secret Scanner detects hardcoded credentials in GitHub organizations and local filesystems.checked 5 Oct 2026
- Remediation
- Findings can include severity, immediate actions, prevention steps, provider-specific rotation commands, and documentation links.checked 5 Oct 2026
- Reports
- It exports findings as JSON, CSV, or SARIF, with SARIF described as compatible with GitHub Advanced Security, Azure DevOps, GitLab Security Dashboard, and SonarQube.checked 5 Oct 2026
- Requirements
- Installation requires Python 3.8+ and Git 2.20+; GitHub organization scanning requires a GitHub token and organization name.checked 5 Oct 2026
- Security behavior
- The scanner says it does not attempt to authenticate with or test detected credentials; matches require manual verification.checked 5 Oct 2026
- Security handling
- The security guidance says findings are masked in logs and advises encrypting reports that contain finding details.checked 5 Oct 2026
- Who it is for
- The README lists security teams, DevOps/SRE, developers, and compliance teams as use cases.checked 5 Oct 2026
Where it runs
- Platforms
- The README documents macOS Spotlight, Linux locate, and Windows PowerShell optimizations, with Python filesystem traversal as a fallback.checked 5 Oct 2026
Alternatives to Git Secret Scanner
- 1
DeepSource
Free planWebAPILinuxmacOS8.0From $30 a month - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Vooda AI
Free planWebAPILinuxmacOS6.9Free plan - 4
Arnica Secrets Security
Free planWebAPISelf-hosted6.6From $300 a year - 5
GitGuardian
Free planWebAPILinuxmacOS6.6Free plan - 6
detect-secrets
Free planLinuxmacOSSelf-hostedWindows6.5Free plan