Gitleaks

It runs locally or in CI, checks every commit, and flags anything that looks like a credential.

MIT license, Go. Fast. Scans entire repositories in seconds. Comes with 150+ built-in rules for common secret patterns: AWS keys, Stripe tokens, private keys, JWTs. You can add custom rules via a TOML config. Runs as a pre-commit hook or in GitHub Actions, GitLab CI, any pipeline.

The CLI tool is fully free and open source. Gitleaks also offers a commercial SaaS product at gitleaks.io with team dashboards and centralized management, but the core scanner is the same. For solo developers and small teams: install it, add the pre-commit hook, done. Five minutes of setup, zero ongoing cost. Medium to large teams might want the commercial dashboard for visibility across repos.

The catch: Gitleaks finds secrets, but it doesn't revoke them. When it flags a leaked AWS key, you still need to rotate it yourself. And regex-based detection means false positives happen; high-entropy strings in test fixtures will trigger alerts. You'll spend some time tuning your .gitleaks.toml allowlist.