detect-secrets vs git-secrets

detect-secrets is a free, open-source Python module for finding secrets in codebases and helping stop new secrets from entering Git changes. It runs on Linux, macOS, and Windows, with self-hosted use documented through pip or Homebrew. Heuristic regular expressions inspect changes for newly committed secrets, alongside entropy and keyword detection. The scan command creates or updates a baseline of potential findings; hook flags new secrets; and audit lets analysts review, label, report, or compare baseline entries. Users can configure it as a pre-commit hook with the pre-commit framework. Built-in plugins and filters can be adjusted, and custom detector plugins and filters can be developed. Exclusions, matching-line or file exclusions, secret-value exclusions, and inline allowlist comments help handle false positives. The package can also be imported into Python scripts to scan files and serialize findings. Word-list filtering and gibberish detection require optional packages, and gibberish detection is disabled by default. The project uses Apache-2.0 licensing.

git-secrets has no write-up on Specifiction yet; its figures are above.