Gitleaks
Finds secrets (API keys, passwords, tokens) in git history, files or a stream. Hook it to commits so a key an agent pasted never leaves your machine. MIT licence.
Strengths
- A single binary, no service or account: it runs locally, your code does not leave
- Runs on staged changes at commit time, so fast even on a large repo
Limitations
- Only recognises the secret shapes it knows: a homemade password gets through
- A local hook can be bypassed with --no-verify: run the same check in CI
Best for
- Any repo where an agent commits, before the first push