Skip to content
SPECIFICTION
Get listed

detect-secrets

github.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 8.5 #3 of 24 in Secrets Scanning Software

What it is

detect-secrets is a free, open-source Python module for finding secrets in codebases and helping stop new secrets from entering Git changes. It runs on Linux, macOS, and Windows, with self-hosted use documented through pip or Homebrew. Heuristic regular expressions inspect changes for newly committed secrets, alongside entropy and keyword detection. The scan command creates or updates a baseline of potential findings; hook flags new secrets; and audit lets analysts review, label, report, or compare baseline entries. Users can configure it as a pre-commit hook with the pre-commit framework. Built-in plugins and filters can be adjusted, and custom detector plugins and filters can be developed. Exclusions, matching-line or file exclusions, secret-value exclusions, and inline allowlist comments help handle false positives. The package can also be imported into Python scripts to scan files and serialize findings. Word-list filtering and gibberish detection require optional packages, and gibberish detection is disabled by default. The project uses Apache-2.0 licensing.

Spec sheet

Purpose
detect-secrets detects secrets in code and helps prevent new secrets from entering a codebase.Read 9 Oct 2026 · github.com
Intended users
The project describes itself as designed with the enterprise client in mind.Read 4 Oct 2026 · github.com
Integrations
The README documents installation through pip and Homebrew and integration as a pre-commit hook.Read 9 Oct 2026 · github.com
License
The repository identifies its license as Apache-2.0.Read 9 Oct 2026 · github.com
Audit
The audit command lets analysts label baseline findings as true or false positives and report or compare results.Read 9 Oct 2026 · github.com
Baseline
A scan creates a baseline of potential secrets already present in a repository.Read 4 Oct 2026 · github.com
Baselines
The scan command creates or updates a baseline of potential secrets found in a repository.Read 9 Oct 2026 · github.com
Custom detectors
Users can develop custom detector plugins and use them with the engine.Read 9 Oct 2026 · github.com
Customization
Users can develop custom detector plugins and filters, and adjust built-in plugins and filters.Read 4 Oct 2026 · github.com
Detection
Its detection strategies include regex rules, entropy heuristics, and keyword detection.Read 9 Oct 2026 · github.com
Detection approach
It checks code changes using heuristically crafted regular expressions to identify newly committed secrets.Read 4 Oct 2026 · github.com
Detection methods
Its detection strategies include regex rules, entropy detection, and keyword detection.Read 4 Oct 2026 · github.com
False positive handling
Users can exclude matching lines, files, or secret values and can use inline allowlist comments.Read 4 Oct 2026 · github.com
False positives
Users can tune scanning with built-in or custom filters, exclusions, and inline allowlist comments.Read 9 Oct 2026 · github.com
Installation
The project documents installation with pip or Homebrew.Read 4 Oct 2026 · github.com
Limitations
The project says its heuristic hook does not prevent every secret and lists multiline secrets and some default passwords as cases it will not prevent.Read 9 Oct 2026 · github.com
Optional extensions
Word-list filtering and the gibberish detector require optional packages; the gibberish detector is not enabled by default.Read 4 Oct 2026 · github.com
Optional extras
Word-list filtering and a gibberish detector are optional features that require additional packages.Read 9 Oct 2026 · github.com
Python use
The package can also be imported into Python scripts to scan files and serialize findings.Read 9 Oct 2026 · github.com
Scanning tools
The project provides scan, hook, and audit commands to create baselines, flag new secrets, and review baseline findings.Read 4 Oct 2026 · github.com
Workflow
The project recommends using detect-secrets as a pre-commit hook through the pre-commit framework.Read 9 Oct 2026 · github.com

Plans and prices

detect-secrets Free Open-source Python module; install with pip or Homebrew Read 9 Oct 2026 · github.com

Every detect-secrets plan and price →

Strong points and limits

Strong points

  • Free Apache-2.0 open-source module
  • Supports Linux, macOS, and Windows
  • Baseline, hook, and audit commands included
  • Custom detectors and filters are supported
  • Pre-commit integration is recommended

Limits

  • Heuristic hooks do not catch every secret
  • Multiline secrets may evade detection
  • Some default passwords may not be prevented
  • Optional detectors require extra packages

Who it suits

It suits enterprise-oriented development teams using Git who want repository scanning and pre-commit checks. Python users can also import the package into scripts.

Verdict

detect-secrets provides a configurable baseline-and-hook workflow for secret detection across common desktop platforms. Its documented limitations mean the heuristic checks should not be treated as complete coverage.

Where Specifiction places it

Alternatives to detect-secretsAll alternatives →