Skip to content
SPECIFICTION
Get listed

Git Secret Scanner

github.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 7.7 #13 of 24 in Secrets Scanning Software

Spec sheet

Purpose
Git Secret Scanner detects hardcoded credentials in GitHub organizations and local filesystems.Read 5 Oct 2026 · github.com
Platforms
The README documents macOS Spotlight, Linux locate, and Windows PowerShell optimizations, with Python filesystem traversal as a fallback.Read 5 Oct 2026 · github.com
Integrations
The README provides GitHub Actions and GitLab CI examples and documents SARIF upload to GitHub Advanced Security.Read 5 Oct 2026 · github.com
License
The repository states that the tool is MIT licensed and may be used and modified for personal or commercial projects.Read 5 Oct 2026 · github.com
Coverage
It lists patterns for credentials and tokens including AWS, GCP, Azure, GitHub, Slack, Stripe, JWT, SSH/PEM keys, and database URIs.Read 5 Oct 2026 · github.com
Detection
The README describes pattern matching, Shannon entropy analysis, context scoring, and denylist filtering to reduce false positives.Read 5 Oct 2026 · github.com
Limits
The documented defaults include a 10 MB maximum file size, local scan depth of 10, and concurrency of 5 repositories and 50 files.Read 5 Oct 2026 · github.com
Remediation
Findings can include severity, immediate actions, prevention steps, provider-specific rotation commands, and documentation links.Read 5 Oct 2026 · github.com
Reports
It exports findings as JSON, CSV, or SARIF, with SARIF described as compatible with GitHub Advanced Security, Azure DevOps, GitLab Security Dashboard, and SonarQube.Read 5 Oct 2026 · github.com
Requirements
Installation requires Python 3.8+ and Git 2.20+; GitHub organization scanning requires a GitHub token and organization name.Read 5 Oct 2026 · github.com
Security behavior
The scanner says it does not attempt to authenticate with or test detected credentials; matches require manual verification.Read 5 Oct 2026 · github.com
Security handling
The security guidance says findings are masked in logs and advises encrypting reports that contain finding details.Read 5 Oct 2026 · github.com
Who it is for
The README lists security teams, DevOps/SRE, developers, and compliance teams as use cases.Read 5 Oct 2026 · github.com

Plans and prices

Git Secret Scanner Free MIT licensed · free for commercial and personal use Read 5 Oct 2026 · github.com

Every Git Secret Scanner plan and price →

Where Specifiction places it

Alternatives to Git Secret ScannerAll alternatives →