Gitleaks vs TruffleHog vs DotGuard: I Scanned the Same 50 Repos With All Three

Description and use

Choosing the right secret scanner matters: Gitleaks balances detection, TruffleHog verifies live keys, and DotGuard quickly finds .env leaks. Combine them for full coverage.

Problem

Teams struggle to choose a secret scanner that balances detection accuracy, speed, and integration ease, especially when secrets are hidden in various formats and git history.

Outcome

TruffleHog found all 60 secrets (41 verified), Gitleaks found 57 (9 FP), DotGuard found 58 (0 FP). Runtime: DotGuard 47s, Gitleaks 4m32s, TruffleHog 11m08s. DotGuard uniquely deduplicates history findings.

Workflow

• 1. Assemble 50 test repos: 20 public, 20 realistic, 10 trap with 60 secrets.
• 2. Run each scanner (Gitleaks, TruffleHog, DotGuard) three times with default configs, record median results.
• 3. Compare detection counts, false positives, runtime, and history handling.
• 4. Analyze strengths: Gitleaks balanced, TruffleHog verifies, DotGuard fastest and cleanest JSON report.
• 5. Decide tool mix: Gitleaks in pre‑commit, DotGuard in CI, TruffleHog nightly for verification.
• 6. Implement CI steps: Gitleaks action, DotGuard npm install + scan, TruffleHog action with scopes.

Evidence

TruffleHog found all 60. 41 of the 60 came back as verified.

Source

DotGuard found 58 and reported zero false positives on this set.

Source

Median runtimes across the 50 repos: DotGuard 47s, Gitleaks 4m32s, TruffleHog 11m08s.

Source