- Gitleaks is MIT licensed. However gitleaks-action has a non-standard license which requires registering (for free)
- Github offers secret scanning on all public repos
- For private repos, there is Github secret protection, which requires a GitHub Team or GitHub Enterprise Cloud account.
- Github secret scanning - note that "non-provider" patterns are enabled separately, and there is a separate AI tool under the Copilot brand.
- Gitleaks
- Gitleaks allows you to define an arbitrary number of rules (regex and entropy based)
- Github lets you define up to 100 custom patterns
- Github's secret scanning has a push protection feature. This is available for most but not all secret types. For some secret types Github can also report the disclosure directly to the provider.
- Gitleaks must be set up as a pre-commit hook
- Github secret scanning is a managed service configured by repository settings
- Gitleaks requires an installation step (varying per OS) unless you run it in docker. It also requires an extra tool (pre-commit or another way of managing git hooks), complicating dev environment setup
- With github secret scanning's push protection, the push is blocked and you need to bypass it
- With Gitleaks you need to add false positives to an allow list