detect-secrets vs Secretlint

detect-secrets is a free, open-source Python module for finding secrets in codebases and helping stop new secrets from entering Git changes. It runs on Linux, macOS, and Windows, with self-hosted use documented through pip or Homebrew. Heuristic regular expressions inspect changes for newly committed secrets, alongside entropy and keyword detection. The scan command creates or updates a baseline of potential findings; hook flags new secrets; and audit lets analysts review, label, report, or compare baseline entries. Users can configure it as a pre-commit hook with the pre-commit framework. Built-in plugins and filters can be adjusted, and custom detector plugins and filters can be developed. Exclusions, matching-line or file exclusions, secret-value exclusions, and inline allowlist comments help handle false positives. The package can also be imported into Python scripts to scan files and serialize findings. Word-list filtering and gibberish detection require optional packages, and gibberish detection is disabled by default. The project uses Apache-2.0 licensing.

Secretlint is a free, MIT-licensed, open-source linting tool for finding credentials in projects and helping prevent commits that contain them. Its command-line interface scans files, glob patterns, or standard input. Detection rules are separate modules, and custom rules can be distributed as npm packages. Secret values are masked in lint error messages by default, reducing exposure in terminal output and logs. Secretlint supports Git workflows, including pre-commit integrations with Husky and lint-staged, pre-commit, and Git hooks. Documentation covers GitHub Actions checks and pull-request annotations through the GitHub formatter. Listed integrations also include Mega-Linter, SARIF formatting, a browser extension, and a macOS clipboard app. The WebExtension works with Chrome and Firefox DevTools to help notice credentials in requests and responses. Installation options include Node.js, Docker, or a single executable without Node.js; the Node.js route requires version 22 or later. It detects secrets but does not automatically fix them.