Gitleaks
CLI that scans git history and pre-commit staging for leaked secrets — API keys, JWTs, SSH private keys, plaintext passwords.
Zachary Rice, 2018. Written in Go, regex-based rules (default 100+ providers: AWS, Stripe, GitHub PATs, Slack tokens, …). Pre-commit hook + CI job is the standard flow. Allowlist file for false positives.
Competitors: TruffleHog (higher recall, more false positives), git-secrets (AWS focus), Detect Secrets (Yelp). GitHub has had built-in "Push Protection" since 2023 but doesn't replace a local CI scanner.