What is Secrets Detection?

Secrets scanning combines known-format patterns (provider key prefixes) with entropy heuristics for opaque strings. The strongest implementations scan git history too, since a secret deleted in a later commit is still exposed in the objects.

Detection is the easy half. A leaked key stays dangerous until it is rotated, so the operationally useful question is what happens after the alert: push protection that blocks the commit, or a ticket someone closes without rotating anything.

Top 16 Secrets Detection tools

Every tool in the directory documented as supporting Secrets Detection, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

1. 1
   CodacyQuality PlatformTeam

   Opengrep and Trivy detect 50+ secret patterns in code, IaC and config files.

2. 2
   AikidoCode Security Platform

   100+ secret patterns: API keys, SSH/PGP keys, AWS, DB creds, OAuth tokens

3. 3
   Checkmarx OneCode Security Platform

   Open-source 2ms engine scans working tree plus optional git commit history; also Slack, Discord, Confluence, Paligo.

4. 4
   CodeAnt AIPR Review

   Real-time secrets detection and redaction, with a Scanning Center for centralized secrets management

5. 5
   CodeRabbitPR ReviewPro

   Gitleaks, Betterleaks, TruffleHog, Presidio in tool catalog; dedicated Secrets scan needs add-on

6. 6
   CorgeaCode Security Platform

   Pattern matching, entropy analysis and AI context

7. 7
   DeepSourceQuality PlatformTeam

   Hybrid regex plus 'Narada' AI classifier; PR checks fail on detection. Team or Enterprise plan required.

8. 8
   Gemini Code AssistAgent Coding Tool

   First-party Gemini CLI Security extension flags hardcoded credentials and keys in diffs.

9. 9
   GitHub Advanced SecurityCode Security PlatformFree on public repos (default patterns); add-on: Secret Protection ($19/committer/mo)

   Provider, generic, AI-detected and custom patterns across full Git history; push protection blocks leaks

10. 10
    GreptilePR Review

    Custom rule can disallow hardcoded secrets; CLI withholds secret-looking files unless --include

11. 11
    QltyQuality PlatformFree (CLI)

    Gitleaks and TruffleHog plugins detect API keys, passwords and other committed secrets

12. 12
    QodoPR Review

    Security compliance check flags exposure of API keys, passwords, secrets in PR changes

13. 13
    SemgrepCode Security Platformadd-on

    Semgrep Secrets is a separately licensed product ($15/contributor); regex, semantic and entropy analysis; excluded from Free.

14. 14
    SnykCode Security Platform

    Snyk Secrets uses entropy, ML semantic analysis and regex; IDE, CLI, SCM and PR checks.

15. 15
    SonarQubeQuality Platform

    Hardcoded credentials, API keys, tokens via SonarQube CLI and Cloud staged-file scanning.

16. 16
    VeracodeCode Security Platformadd-on

    Container/IaC scanning detects secrets via configurable RE2 secret-rules; 60+ named provider key types

What to look for

• Whether full git history is scanned, or only the current working tree
• Push protection, since blocking the secret before it lands beats alerting after
• Custom pattern support for your own internal token formats
• How generic high-entropy strings are handled without drowning you in noise

Related terms

FAQ