Arnica Secrets Security vs TruffleHog

Arnica Secrets Security detects and validates hardcoded secrets in code repositories. For newly pushed validated secrets, it can automatically rewrite commits and remove secrets from Git history. Severity considers validation context, including whether credentials belong to a highly privileged or development account. Codebases are scanned daily, with secrets revalidated on code changes and scheduled scans. Integrations include GitHub, GitLab, Azure DevOps, and Bitbucket; alerts can go to Slack or Microsoft Teams, while tickets can be created through Jira or Azure DevOps Boards. Teams can configure regex-based detectors, ignored paths, and policies for scanning and resolution. Arnica says it does not persist source-code snippets containing detected secrets and that customer data is encrypted at rest with tenant separation. Its cloud infrastructure is hosted on AWS, with TLS 1.2 or 1.3 in transit and AES 256 at rest. The Free plan's data ingestion runs every seven days; premium plans run in real time. Prices are per identity per year: Free is free, Business is $300 a year, and Enterprise is $600 a year. A 14-day trial is available.

TruffleHog scans code repositories and other sources for exposed secrets, passwords, and sensitive keys. It checks version history across branches and can find credentials in comments and Docker images, among other locations. For detected credentials, it checks the relevant protocol or API to determine whether they are live, helping reduce false positives. Its Analyze feature identifies the resources and permissions associated with API keys and other secrets without requiring access to a provider’s user interface. Pre-commit and pre-receive hooks can scan changes before they are committed. Alerts can point to credential-rotation actions and security guidance. Integrations include GitHub, GitLab, Bitbucket, Gerrit, Docker, Jenkins, Slack, Teams, Jira, Confluence, Google Drive, S3, and SharePoint, among others. Notifications can go to Slack, Jira, Splunk, webhooks, email, or stdout. The open-source plan costs nothing and includes 800+ secret detectors.