CheckOps home

Tools directory

D

CheckOps

detect-secrets

detect-secrets is Yelp's Apache-2.0, enterprise-friendly module for preventing new secrets entering a codebase, detecting committed secrets and tracking them with a baseline file.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

detect-secrets, from Yelp, is designed with enterprises in mind: it provides a backwards-compatible, systematic way of preventing new secrets from entering the codebase, detecting if secrets have already been committed, and auditing them. A baseline file records known findings so only new secrets block commits.

The source code is at Yelp/detect-secrets on GitHub under the Apache-2.0 licence, with about 4,700 stars; the most recent commit was on 2 April 2026.

Features

  1. Baseline file: Track and audit existing findings.
  2. Pre-commit hook: Block new secrets.
  3. Plugins: Entropy and keyword detectors plus provider patterns.
  4. Audit workflow: Mark findings as true or false positives.
  5. Filters: Reduce false positives.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 2 April 2026.
  3. Community: About 4,700 GitHub stars.

Cons

  1. Less frequent updates: Last commit April 2026.
  2. No live verification: Does not validate secrets.
pip install detect-secrets
detect-secrets scan > .secrets.baseline
detect-secrets audit .secrets.baseline

Resources:

Pricing

detect-secrets is free and open source under the Apache-2.0 licence.

  1. Large codebases that need a baseline approach.
  2. Python-friendly teams using pre-commit.
  3. Not a fit if you need verification of live secrets.

Conclusion

detect-secrets is a pragmatic, baseline-driven way to stop new secrets.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with detect-secrets side by side.