detect-secrets vs KeyHog

detect-secrets is a free, open-source Python module for finding secrets in codebases and helping stop new secrets from entering Git changes. It runs on Linux, macOS, and Windows, with self-hosted use documented through pip or Homebrew. Heuristic regular expressions inspect changes for newly committed secrets, alongside entropy and keyword detection. The scan command creates or updates a baseline of potential findings; hook flags new secrets; and audit lets analysts review, label, report, or compare baseline entries. Users can configure it as a pre-commit hook with the pre-commit framework. Built-in plugins and filters can be adjusted, and custom detector plugins and filters can be developed. Exclusions, matching-line or file exclusions, secret-value exclusions, and inline allowlist comments help handle false positives. The package can also be imported into Python scripts to scan files and serialize findings. Word-list filtering and gibberish detection require optional packages, and gibberish detection is disabled by default. The project uses Apache-2.0 licensing.

KeyHog is free, open-source Rust software for finding and verifying exposed API keys, tokens, passwords, and other credentials. It scans source repositories and Git history, archives, Docker images, URLs and HAR captures, collaboration content, VCS inventories, cloud-storage inventories, browser assets, and running systems. The project lists 934 service-specific detectors, decode-before-scanning, contextual evidence and suppression, and optional live provider verification. GPU execution can use CUDA, native Metal, or portable WGPU, with calibration selecting a parity-backed option. Its GitHub Action scans checked-out trees, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact. Documented CI integrations include GitLab, CircleCI, Jenkins, Buildkite, and shell jobs. A Unix daemon checks changed repository blobs before commits; Windows uses in-process scanning. KeyHog runs on Linux, macOS, Windows, and self-hosted deployments, and requires Rust 1.89 or newer. Code and detector TOMLs are licensed MIT OR Apache-2.0. The plan costs nothing.