Security scanning

What is secrets detection?

Finding credentials (API keys, tokens, private keys, connection strings) committed to code, config files or git history.

By Cláudia FernandesUpdated 2026-10-02

Secrets scanning combines known-format patterns (provider key prefixes) with entropy heuristics for opaque strings. The strongest implementations scan git history too, since a secret deleted in a later commit is still exposed in the objects.

Detection is the easy half. A leaked key stays dangerous until it is rotated, so the operationally useful question is what happens after the alert: push protection that blocks the commit, or a ticket someone closes without rotating anything.

What to look for

Whether full git history is scanned, or only the current working tree
Push protection, since blocking the secret before it lands beats alerting after
Custom pattern support for your own internal token formats
How generic high-entropy strings are handled without drowning you in noise

Best 16 secrets detection tools

Every tool in the directory whose documentation covers this. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Aikido

100+ secret patterns: API keys, SSH/PGP keys, AWS, DB creds, OAuth tokens

Code Security Platform

Checkmarx One

Open-source 2ms engine scans working tree plus optional git commit history; also Slack, Discord, Confluence, Paligo.

Code Quality Platform

Codacy

Opengrep and Trivy detect 50+ secret patterns in code, IaC and config files.

PR Review Tool

CodeAnt AI

Real-time secrets detection and redaction, with a Scanning Center for centralized secrets management

PR Review Tool

CodeRabbit

Gitleaks, Betterleaks, TruffleHog, Presidio in tool catalog; dedicated Secrets scan needs add-on

Code Security Platform

Corgea

Pattern matching, entropy analysis and AI context

Code Quality Platform

DeepSource

Hybrid regex plus 'Narada' AI classifier; PR checks fail on detection. Team or Enterprise plan required.

AI Coding Agent

Gemini Code Assist

First-party Gemini CLI Security extension flags hardcoded credentials and keys in diffs.

Code Security Platform

GitHub Advanced Security

Provider, generic, AI-detected and custom patterns across full Git history; push protection blocks leaks

PR Review Tool

Greptile

Custom rule can disallow hardcoded secrets; CLI withholds secret-looking files unless --include

Code Quality Platform

Qlty

Gitleaks and TruffleHog plugins detect API keys, passwords and other committed secrets

PR Review Tool

Qodo

Security compliance check flags exposure of API keys, passwords, secrets in PR changes

Code Security Platform

Semgrep

Semgrep Secrets is a separately licensed product ($15/contributor); regex, semantic and entropy analysis; excluded from Free.

Code Security Platform

Snyk

Snyk Secrets uses entropy, ML semantic analysis and regex; IDE, CLI, SCM and PR checks.

Code Quality Platform

SonarQube

Hardcoded credentials, API keys, tokens via SonarQube CLI and Cloud staged-file scanning.

Code Security Platform

Veracode

Container/IaC scanning detects secrets via configurable RE2 secret-rules; 60+ named provider key types

SAST Taint Analysis (Data-Flow)Secrets Validation SCA Reachability Analysis Malicious Package Detection

FAQ