CheckOps home

Tools directory

T

CheckOps

Talisman

Talisman is ThoughtWorks' MIT-licensed pre-commit and pre-push hook that inspects outgoing changesets for suspicious content such as tokens, passwords and private keys.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Talisman, from ThoughtWorks, installs as a Git hook. Using a pre-commit (or pre-push) hook, it validates the outgoing changeset for things that look suspicious, such as tokens, passwords and private keys, and stops them before they leave the developer’s machine.

The source code is at thoughtworks/talisman on GitHub under the MIT licence, with about 2,100 stars; the most recent commit was on 1 March 2026.

Features

  1. Git hooks: Pre-commit and pre-push.
  2. Pattern and entropy checks: Detect tokens, keys and suspicious files.
  3. Ignore file: .talismanrc for accepted findings.
  4. Scan mode: Scan repository history.
  5. Hook framework support: Works with pre-commit and Husky.

Pros

  1. Free to use: Open source under MIT.
  2. Maintained: Commits as recent as 1 March 2026.

Cons

  1. Local-first: Developers can bypass hooks, so keep a CI check too.
  2. Last commit March 2026: Check activity before adopting.

Install per the README, then commit as usual; Talisman runs automatically. To scan history:

talisman --scan

Resources:

Pricing

Talisman is free and open source under the MIT licence.

  1. Teams wanting secrets blocked on developer machines.
  2. Organisations standardising Git hooks.
  3. Not a fit as the only control; pair with CI scanning.

Conclusion

Talisman stops secrets at commit time with simple Git hooks.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Talisman side by side.