Arnica Secrets Security

Arnica Secrets Security is a repository-focused tool for finding, validating and remediating exposed credentials. It fits development and security teams that need findings connected to pull requests, chat and ticket workflows. The main choice is between a capable free baseline and paid plans that remove the free tier’s weekly ingestion delay.

Overview

Arnica detects hardcoded secrets, checks whether they are valid and can automatically respond to newly pushed secrets it validates. Its severity model uses context such as whether a credential belongs to a highly privileged or development account, giving teams a more useful way to prioritize exposure than treating every match equally.

Daily codebase scans and revalidation after code changes keep results current. Pull-request scanning and push protection extend coverage into development workflows, while configurable resolution policies help teams decide how findings should be handled.

Key features

When Arnica validates a newly pushed secret, it can rewrite commits and remove the credential from Git history. Business adds real-time mitigation and a policy that blocks new secrets, making it the more appropriate tier for teams that need an immediate response rather than periodic discovery. The remediation scope still depends on validation, so an unvalidated match is not automatically treated the same way.

Custom regex detectors, ignored paths and policies for scanning and resolution let teams tune coverage to their repositories. Arnica connects to GitHub, GitLab, Azure DevOps and Bitbucket. Alerts can be sent to Slack or Microsoft Teams, while Jira and Azure DevOps Boards support ticket workflows.

Arnica says source-code snippets containing detected secrets are not persisted. Customer data is encrypted at rest with AES 256, protected in transit with TLS 1.2 or 1.3, and separated by tenant on AWS infrastructure. The company states that it is SOC 2 Type 2 compliant and undergoes annual third-party examination of its controls.

Pricing

Arnica uses per-identity annual billing. A billable identity is a user or other contributing entity with code contributions or pull-request activity in the previous 90 days; duplicates are removed across organizations. That definition can make the effective cost differ from a simple employee-seat count.

PlanPriceWhat it includesFreefree, billed Per Identity / YearWeekly automated reports; SAST, SCA, IaC, licensing and reputation scans; secrets scanning; SSO; customer success.Business$300 a year, billed Per Identity / Year30 AI credits per identity; real-time scanning; Slack and Microsoft Teams ChatOps; zero new secret policy enforcement; real-time secrets mitigation.Enterprise$600 a year, billed Per Identity / Year100 AI credits per identity; custom code-risk and secret rules; Arnica API; on-premise instance support; Jira integration.A 14-day trial provides a short evaluation window before commitment. Free is a sensible starting point for teams that can accept ingestion every seven days and do not need real-time response. Business is the practical upgrade for continuous scanning and automated secret handling. Enterprise earns its premium where custom rules, API access, Jira or on-premise support matter. On-premise deployment is treated as an add-on in the pricing comparison, so it should not be assumed to be included without qualification.

Platforms

Arnica is offered through an API, self-hosted deployment and web interface. Supported version-control systems are GitHub, GitLab, Bitbucket and Azure DevOps. Enterprise includes support for an on-premise instance, with on-prem deployment marked as an add-on.

Who it's for

Choose Arnica if your team wants secret detection tied to validation, severity context and a defined remediation path across major Git providers. Business suits organizations that cannot wait a week for ingestion; Enterprise is aimed at teams requiring deeper policy customization, API integration, Jira workflows or on-premise support.

It is a weaker fit when weekly free-tier ingestion is too slow and paid per-identity billing does not match your budgeting model, or when your priority is a broader security platform rather than repository-secret controls.

Pros and cons

Pros

Validation-aware severity: privileged and development-account context helps focus response on higher-impact credentials.

Remediation beyond alerts: validated newly pushed secrets can be removed from Git history through commit rewriting.

Workflow coverage: pull-request scanning, push protection, chat alerts and ticket integrations connect detection to engineering processes.

Configurable controls: custom detectors, ignored paths and policy settings support repository-specific rules.

Defined data protections: non-persistence of secret-bearing snippets, tenant separation and stated SOC 2 Type 2 compliance address handling concerns.

Cons

Free-tier delay: data ingestion every seven days is unsuitable for teams needing immediate detection.

Paid real-time coverage: continuous scanning, enforcement and mitigation begin with Business at $300 per year.

Validation dependency: automated history rewriting is described for secrets Arnica validates, not every detected string.

Enterprise extras cost more: custom rules, API access, Jira and on-premise support are reserved for the 600.00 USD per-identity annual tier, with on-premise marked as an add-on.

Alternatives

Secrets Scanning Software is the relevant category comparison for teams evaluating dedicated secret-detection products. For a wider governance view, compare Application Security Posture Management Software.

OWASP DefectDojo is the better direction for teams wanting an open-source community edition and broader vulnerability-management workflow. Strobes ASPM suits organizations seeking an ASPM platform with a free tier capped at 100 assets and 500 tasks per month. OX Security is worth choosing when a paid platform combining SAST, SCA, secrets, SBOM, IaC, CI/CD and container scanning is the priority.

SecurStack fits smaller teams wanting a free extension/web service with 500 scan credits per month, three users and ten projects. Conviso Platform is an alternative for teams budgeting around contributing developers, assets, users and integrations. Phoenix Security is aimed at asset-focused security management with a free allowance of up to 1,000 assets. apPosture API Security is worth considering when API security is central alongside SAST, SCA, secrets and IaC. Ivanti Neurons for Zero Trust Access is a separate paid zero-trust access product rather than a direct secrets-scanning substitute.

Verdict

Arnica is a strong choice for teams that want validated secret findings connected to enforcement and remediation across their existing Git and collaboration stack. Choose Business for real-time protection or Enterprise for API, custom-rule, Jira and on-premise requirements. Look elsewhere if weekly free-tier ingestion is acceptable only in theory, or if your priority is a broader application-security platform rather than focused secrets control.