Secret scanners
These tools look for credentials in git or in a GitHub repository. A finding means you should rotate the key. Deleting the file in a later commit does not remove it from history.
Last updated
| Tool | Price | What it catches | Who it suits |
|---|---|---|---|
| Aikido | Included in the $0 Developer plan described on Aikido's pricing page, alongside the other free features and the 10-repo limit. | Secrets detection is on the free feature list, together with SAST and dependency scanning. | A team already using Aikido for more than secrets alone. |
| GitHub secret scanning | Secret scanning and push protection are free for public repositories by default. Organization-owned private repositories need GitHub Secret Protection. A single public per-committer price is not stated. | Known credential patterns already committed, and some pushes of those patterns before they land on a public repo. | Code hosted on GitHub. Confirm the setting on a private repository instead of assuming it is scanned. |
| Gitleaks | The CLI license requirement is not stated on the GitHub Action README. That README says personal repositories need no license key, and it describes a free starter license for one organization repository. | Secrets in a git history you scan from your own machine or from CI. | Someone who can run a scanner locally. Read the current CLI license before you rely on it. |
Sources
Each cell is a shorter restatement of that tool's page on this site. The tool page lists the public URL that was checked and anything still unknown.
- Aikido, checked 2026-10-13. www.aikido.dev/pricing, www.aikido.dev/
- GitHub secret scanning, checked 2026-10-13. docs.github.com/en/code-security/getting-started/github-security-features, docs.github.com/en/code-security/concepts/secret-security/secret-scanning
- Gitleaks, checked 2026-10-13. github.com/gitleaks/gitleaks, github.com/gitleaks/gitleaks-action