Open-source alternatives to Detect Secrets

Tsunami Security Scanner is a network vulnerability scanner and security auditor designed to identify high-severity flaws across network assets. It functions as an asynchronous security probe engine that utilizes automated probes and specialized detection logic to find critical weaknesses and prioritize remediation efforts. The project is distinguished by a plugin-based scanning engine, which uses a modular architecture of interchangeable detection plugins to identify vulnerabilities. This extensibility allows for the development and integration of custom security plugins to expand the variet

Git-secrets is a security utility designed to prevent the accidental exposure of sensitive credentials by integrating automated scanning directly into the version control commit lifecycle. It functions as a commit scanner that evaluates staged files and commit messages against defined security policies before changes are finalized in a repository. The tool utilizes regular expression pattern matching to identify potential secrets and supports the registration of custom patterns to address specific organizational security requirements. To manage operational friction, it includes mechanisms for

Checkov is a static analysis tool and security scanner designed to identify misconfigurations in infrastructure as code, container images, and Kubernetes configurations. It functions as a cloud security posture tool, an SCA vulnerability scanner, and a secret scanning utility to prevent security breaches and version control leaks. The project distinguishes itself through deep graph analysis and variable resolution, allowing it to map relationships between interconnected resources and evaluate the final state of infrastructure attributes. It provides extensibility for defining custom security

A static analysis tool for securing Go code

Scan your code for security misconfiguration, search for passwords and secrets. :mag:

Fast GitHub recon tool. Scans for leaked secrets across all of GitHub, not just known repos and orgs. Support for GitHub dorks.

Identify hardcoded secrets in static structured text

Scorecard is an open source security scanner and software supply chain analysis tool that evaluates the security posture of projects by calculating risk metrics based on best practices. It functions as a security health dashboard, visualizing security gaps through scores and badges to help maintainers identify vulnerabilities. The project provides a system for monitoring repository security through a GitHub Action security auditor that alerts maintainers when security scores drop. It also offers a mechanism for vulnerability remediation guidance, mapping identified security gaps to prescripti

Trufflehog is a security tool designed to continuously monitor code repositories and cloud environments to detect, verify, and remediate exposed sensitive credentials and API keys. It functions as a comprehensive secret scanning engine that integrates directly into deployment pipelines and version control systems to intercept sensitive data before it is committed or pushed. By utilizing read-only operations and volatile memory processing, the system ensures that discovered credentials are never stored persistently, maintaining strict data privacy throughout the scanning lifecycle. The platfor

A Github scanning tool that identifies hardcoded credentials while filtering the false positive data through machine learning models :lock:

Using a pre-commit hook, Talisman validates the outgoing changeset for things that look suspicious — such as tokens, passwords, and private keys.

weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.

Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain. The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations agai

Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

Gitrob is a tool that scans public GitHub repositories for potentially sensitive files. It clones repositories and walks through their full commit history to flag files matching signatures for sensitive content, including files that may have been deleted in later commits. The tool presents its findings through a local web interface for interactive browsing and analysis. It serves results directly from memory without requiring a database, and allows users to save the full set of gathered findings to a JSON session file. Saved sessions can be loaded back into the web interface to continue analy

Apkleaks is a static analysis tool and security auditor designed to extract hardcoded secrets, API endpoints, and sensitive data from Android application packages. It operates as a secret scanner that analyzes compiled binaries without executing them to identify potential information leaks and insecure endpoints. The tool utilizes a regex-based data extraction engine to identify sensitive strings within decompiled code. It supports customization through JSON-defined search patterns and provides configuration flags to tune the behavior of the underlying disassembler. The analysis pipeline enc

CKEditor 4 is a browser-based WYSIWYG rich text editor that enables users to create and format HTML content directly in the browser. It operates on a plugin-based architecture with a configurable toolbar system, DOM-based content editing, and an event-driven lifecycle, all delivered through a CDN-based distribution model. The editor supports skin-based theming and includes a legacy plugin compatibility layer for backward compatibility. The editor distinguishes itself as a cross-platform framework that integrates natively with Angular, React, Vue, Electron, Android, and iOS environments. It of

Albert is a keyboard launcher that opens files, applications, and runs commands by typing search queries into a search bar. It functions as a keyboard-driven workflow tool, enabling users to navigate their file system, launch installed applications, and execute shell commands without touching a mouse. The launcher processes user input through a plugin-based modular architecture, where functionality is extended by dynamically loaded C++ and Python plugins. Queries are dispatched to all enabled handlers in parallel, with results merged and ranked by a combination of match quality and historical

This project is a set of git pre-commit hooks designed to automate the formatting, linting, and validation of Terraform configurations. It functions as an infrastructure as code linter, security scanner, cost estimator, and documentation generator to ensure code quality before commits are finalized. The tool distinguishes itself by providing specialized capabilities for infrastructure workflows, such as scanning templates for security vulnerabilities and hardcoded secrets, calculating projected cloud spending against budgets, and automatically extracting module definitions to populate readme

DevOps-Bash-tools is a collection of shell scripts and aliases designed to automate cloud infrastructure, container orchestration, and CI/CD pipelines. It provides a comprehensive toolset for managing operational workflows through the command line. The project specializes in automating tasks across multiple platforms, including managing namespaces and secrets in Kubernetes, auditing resources in AWS and GCP, and triggering builds or managing environment variables in GitHub Actions, GitLab CI, and CircleCI. It also includes a toolkit for interacting with container registries to query manifests

Chunjun is a distributed data integration framework and SQL-based ETL pipeline designed to synchronize data between heterogeneous sources. It functions as a change data capture tool and a heterogeneous data synchronizer, utilizing a distributed processing environment to move and transform data across different database types. The system is distinguished by its plugin-based connector architecture, which allows for the development of custom source and sink plugins to extend connectivity to unsupported data systems. It supports real-time change data capture from relational database logs and impl

Lexical is a modular rich text editor framework used to build extensible web-based editors. It functions as a state-driven content editor that maintains a serializable, immutable snapshot of document content to ensure predictable updates and accessibility compliance. The framework is distinguished by its plugin-based architecture and customizable node framework, which allow developers to extend editor behavior through specialized content nodes and encapsulated runtime logic. It also includes a collaborative editing engine capable of synchronizing document state across multiple clients in real

LiteMonitor is a customizable desktop system dashboard and hardware performance monitor. It provides a visual overlay for tracking real-time CPU, GPU, memory, and network metrics, including temperature and power consumption. The application is an extensible system monitor that uses a modular plugin system to integrate third-party data sources, such as weather, stocks, and cryptocurrency, alongside core hardware telemetry. The tool includes a theme engine for adjusting colors, fonts, and layout, as well as window management controls for transparency and click-through behavior. It supports sys

Checkstyle is a Java static analysis tool and linter designed to identify and enforce coding standards and best practices. It functions as a code quality auditor and Javadoc validation tool, checking source code against configurable rulesets to ensure structural and stylistic consistency. The project allows for the creation of custom linting rules by extending a core API to inspect the abstract syntax tree. It further enables specialized validation through the use of XPath expressions to query the syntax tree for specific code patterns and violations. Capability areas include the enforcement

Xboard is a containerized service orchestrator and management platform. It provides a Docker-based administrative dashboard for monitoring and controlling backend system services and configurations through a unified interface for operators and users. The platform utilizes a modular architecture and a dedicated plugin system, allowing for the registration of custom logic and the extension of core administrative functionality. It includes utilities for legacy data migration to transfer records and configurations from previous versions or alternative implementations into the current system sche

Domoticz is a home automation platform and multi-protocol IoT orchestrator designed for controlling smart home devices and automating routines. It functions as an event-driven automation engine and a centralized system for managing connected sensors and hardware across Linux, Windows, and Raspberry Pi. The system acts as a Zigbee and Z-Wave controller and an MQTT IoT gateway, bridging disparate hardware ecosystems through a flexible plugin system. This allows for the unification of various communication standards into a single management interface. The platform covers broad capabilities incl

Cerebro is a cross-platform productivity tool and keyboard-driven command palette. It serves as a central search interface and desktop application launcher for finding and initiating the execution of local files, installed software, and web services. The application is an extensible search tool that supports a plugin system, allowing third-party modules to register custom search providers and new functional capabilities. The software covers several capability areas, including local file system navigation and preview, integrated web search, and productivity utilities for natural language mat