Arnica Secrets Security vs Talisman

Arnica Secrets Security detects and validates hardcoded secrets in code repositories. For newly pushed validated secrets, it can automatically rewrite commits and remove secrets from Git history. Severity considers validation context, including whether credentials belong to a highly privileged or development account. Codebases are scanned daily, with secrets revalidated on code changes and scheduled scans. Integrations include GitHub, GitLab, Azure DevOps, and Bitbucket; alerts can go to Slack or Microsoft Teams, while tickets can be created through Jira or Azure DevOps Boards. Teams can configure regex-based detectors, ignored paths, and policies for scanning and resolution. Arnica says it does not persist source-code snippets containing detected secrets and that customer data is encrypted at rest with tenant separation. Its cloud infrastructure is hosted on AWS, with TLS 1.2 or 1.3 in transit and AES 256 at rest. The Free plan's data ingestion runs every seven days; premium plans run in real time. Prices are per identity per year: Free is free, Business is $300 a year, and Enterprise is $600 a year. A 14-day trial is available.

Talisman is a free, open-source Git tool from ThoughtWorks that installs hooks to check outgoing changes for potential secrets before they leave a workstation. It runs as a pre-commit hook, pre-push hook, or standalone executable, with installation options for a global Git hook template, one repository, or the CLI. Detectors inspect encoded values, file contents, file sizes, high-entropy data, possible credit-card numbers, and filenames or extensions. The CLI can scan Git history for secrets that may already be committed and save reports. A .talismanrc file supports ignored files, allowed patterns, custom search patterns, and detector severity settings. Documentation describes integration with the pre-commit framework and Husky, and lists macOS, Linux, and Windows support. When a check finds a possible issue, Talisman reports the affected file and errors. It is MIT licensed and can be used in CI/CD. Documentation notes that forced-push secrets cannot be detected, and interactive ignore-file configuration is available only to non-Windows users.