Gitleaks vs Talisman

Gitleaks is free, MIT-licensed software that detects secrets such as passwords, API keys, and tokens in Git repositories, files, and standard input. It runs on Linux, macOS, Windows, and self-hosted systems. Scans can target repositories, directories, individual files, or streamed data. Custom rules can use Go regular expressions, entropy checks, path matching, keywords, and allowlists. A previous report can serve as a baseline so later scans show only new findings. Output is available in JSON, CSV, JUnit, SARIF, or template formats. The project documents pre-commit hook and GitHub Action use, plus CI/CD, pull-request, and supported VCS workflows for GitHub, GitLab, Azure DevOps, Gitea, and Bitbucket. Installation options include Homebrew, Docker, Go, and prebuilt release binaries. A redaction option masks secrets in logs and standard output, with a default redaction value of 100%. The project describes itself as feature complete, with future releases limited to security patches, and its security policy supports only the latest version.

Talisman is a free, open-source Git tool from ThoughtWorks that installs hooks to check outgoing changes for potential secrets before they leave a workstation. It runs as a pre-commit hook, pre-push hook, or standalone executable, with installation options for a global Git hook template, one repository, or the CLI. Detectors inspect encoded values, file contents, file sizes, high-entropy data, possible credit-card numbers, and filenames or extensions. The CLI can scan Git history for secrets that may already be committed and save reports. A .talismanrc file supports ignored files, allowed patterns, custom search patterns, and detector severity settings. Documentation describes integration with the pre-commit framework and Husky, and lists macOS, Linux, and Windows support. When a check finds a possible issue, Talisman reports the affected file and errors. It is MIT licensed and can be used in CI/CD. Documentation notes that forced-push secrets cannot be detected, and interactive ignore-file configuration is available only to non-Windows users.