Open-source alternatives to Git All Secrets

This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-part

LLM Guard is a security firewall and guardrail framework designed to scan and sanitize inputs and outputs for large language models. It functions as a proxy gateway and security layer to block prompt injections, toxicity, and sensitive data leakage while ensuring that model interactions remain compliant with organizational policies. The system distinguishes itself through a modular scanner pipeline that utilizes local model orchestration to eliminate external network dependencies. It supports real-time security filtering via streaming chunk analysis and implements a fail-fast execution model

Git-secrets is a security utility designed to prevent the accidental exposure of sensitive credentials by integrating automated scanning directly into the version control commit lifecycle. It functions as a commit scanner that evaluates staged files and commit messages against defined security policies before changes are finalized in a repository. The tool utilizes regular expression pattern matching to identify potential secrets and supports the registration of custom patterns to address specific organizational security requirements. To manage operational friction, it includes mechanisms for

Search exposed EBS volumes for secrets

Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

jsleak is a tool to find secret , paths or links in the source code during the recon.

Finding potential software vulnerabilities from git commit messages

Monitors Github for leaked secrets

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

NOTE: due to dumbass people, automatic issue creation has been turned off until further notice

GitHub Sensitive Information Leakage（GitHub敏感信息泄露监控）

A collection of tools to perform searches on GitHub.

gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

SecretFinder - A python script for find sensitive data (apikeys, accesstoken,jwt,..) and search anything on javascript files

$ ./githarvester.py -h

Gitrob is a tool that scans public GitHub repositories for potentially sensitive files. It clones repositories and walks through their full commit history to flag files matching signatures for sensitive content, including files that may have been deleted in later commits. The tool presents its findings through a local web interface for interactive browsing and analysis. It serves results directly from memory without requiring a database, and allows users to save the full set of gathered findings to a JSON session file. Saved sessions can be loaded back into the web interface to continue analy

Github leaked patrol为一款github泄露巡航工具：

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

A suite of secret scanners built in Rust for performance. Based on TruffleHog (https://github.com/dxa4481/truffleHog) which is written in Python.

Yar is a tool for plunderin' organizations, users and/or repositories.

GitPrey是根据企业关键词进行项目检索以及相应敏感文件和敏感文件内容扫描的工具，其设计思路如下： 根据关键词在GitHub中进行全局代码内容和路径的搜索（in:file,path），将项目结果做项目信息去重整理得到所有关键词相关的项目，即疑似项目结果； 基于PATTERNDB中的敏感文件名或敏感代码对所有疑似项目做文件名搜索（filename:）和代码搜索（in:file）； 将匹配搜索到的结果按照项目整理输出；…