Open-source GitGuardian alternatives

Trivy is a security scanner from Aquasec, written in Go and released under the Apache-2.0 license. It has scanners that look for different security issues and targets where those issues can be found. The README describes it as comprehensive and versatile, and it covers the major programming languages, operating systems and platforms.

Targets include container images, filesystems, remote Git repositories, virtual machine images and Kubernetes. Scanners look for OS packages and software dependencies in use, which produces an SBOM, known vulnerabilities (CVEs), infrastructure-as-code issues and misconfigurations, sensitive information and secrets, and software licenses. Its topics reference DevSecOps and vulnerability scanning.

Trivy is available through most common channels, including Homebrew, a Docker image and downloadable binaries, and integrates with platforms such as GitHub Actions, a Kubernetes operator and a VS Code plugin. Canary builds are produced with each push to the main branch. It suits developers, platform teams and security engineers who want to scan images and code in CI pipelines.

Gitleaks is a tool for detecting secrets such as passwords, API keys and tokens in git repositories, in files, and in anything you pipe to it through standard input. It is written in Go, released under the MIT license, and aimed at DevSecOps, CI/CD and data-loss-prevention use. A maintainer warning in the README says it is feature complete, that future releases will be security patches only, and that the author is shifting focus to a successor project called Betterleaks.

Gitleaks can be installed with Homebrew, Docker or Go, and binaries for many platforms are on the releases page. It can run as a pre-commit hook and has a GitHub Action for CI use. The detection engine is built on regular expressions, and the author has written about how that approach works. It does not need a hosted service, because scans run wherever you execute the binary, including in CI pipelines.

Infisical is an open-source security infrastructure platform used by teams to manage application secrets, certificates and privileged access. It centralizes secrets and configuration across environments, with versioning, rotation and leak prevention. The stack is TypeScript and Go on PostgreSQL, and the project offers both a hosted Infisical Cloud and a self-hosting option.

Secrets are organized by project and environment, such as development and production, in a dashboard. Secret syncs push values to platforms like GitHub, Vercel and AWS and work with tools such as Terraform and Ansible. Further features include point-in-time recovery, scheduled rotation for databases and AWS IAM, ephemeral dynamic secrets, secret scanning that stops leaks into git, a Kubernetes operator, and an agent that injects secrets without code changes. It also offers honey tokens as decoy credentials and brokered access for AI agents. The repository metadata lists the license as Other, so check it for exact terms.

TruffleHog is a tool for discovering, classifying, validating and analyzing secrets, meaning credentials a machine uses to authenticate to another machine, such as API keys, database passwords and private keys. It is written in Go and released under the AGPL-3.0 license. It can be used from the command line and in pre-commit and CI scans as part of DevSecOps work.

Discovery reaches into Git repositories, chat tools, wikis, log files, API testing platforms, object stores and filesystems. Classification identifies more than 800 secret types and maps each to the identity it belongs to. Validation attempts to log in with the found secret to confirm whether it is still live, and analysis for roughly twenty common credential types sends further requests to learn who created the secret and what it can access. Truffle Security also sells an enterprise product that monitors systems such as Git, Jira, Slack and Confluence.