Gitleaks vs TruffleHog vs DotGuard: I Scanned the Same 50 Repos With All Three

Описание и применение

Выбор подходящего сканера секретов критичен: Gitleaks обеспечивает баланс, TruffleHog проверяет живые ключи, а DotGuard быстро обнаруживает утечки в .env‑файлах. Комбинируйте их для полной защиты.

Задача

Teams struggle to choose a secret scanner that balances detection accuracy, speed, and integration ease, especially when secrets are hidden in various formats and git history.

Результат

TruffleHog found all 60 secrets (41 verified), Gitleaks found 57 (9 FP), DotGuard found 58 (0 FP). Runtime: DotGuard 47s, Gitleaks 4m32s, TruffleHog 11m08s. DotGuard uniquely deduplicates history findings.

Рабочий процесс

• 1. Assemble 50 test repos: 20 public, 20 realistic, 10 trap with 60 secrets.
• 2. Run each scanner (Gitleaks, TruffleHog, DotGuard) three times with default configs, record median results.
• 3. Compare detection counts, false positives, runtime, and history handling.
• 4. Analyze strengths: Gitleaks balanced, TruffleHog verifies, DotGuard fastest and cleanest JSON report.
• 5. Decide tool mix: Gitleaks in pre‑commit, DotGuard in CI, TruffleHog nightly for verification.
• 6. Implement CI steps: Gitleaks action, DotGuard npm install + scan, TruffleHog action with scopes.

Доказательства

TruffleHog found all 60. 41 of the 60 came back as verified.

Источник

DotGuard found 58 and reported zero false positives on this set.

Источник

Median runtimes across the 50 repos: DotGuard 47s, Gitleaks 4m32s, TruffleHog 11m08s.

Источник