Gitleaks vs TruffleHog vs DotGuard: I Scanned the Same 50 Repos With All Three

说明与用途

选择合适的秘密扫描器至关重要：Gitleaks 提供平衡检测，TruffleHog 验证实时密钥，DotGuard 快速发现 .env 泄露。将它们组合使用可实现全面保护。

问题

Teams struggle to choose a secret scanner that balances detection accuracy, speed, and integration ease, especially when secrets are hidden in various formats and git history.

结果

TruffleHog found all 60 secrets (41 verified), Gitleaks found 57 (9 FP), DotGuard found 58 (0 FP). Runtime: DotGuard 47s, Gitleaks 4m32s, TruffleHog 11m08s. DotGuard uniquely deduplicates history findings.

工作流

• 1. Assemble 50 test repos: 20 public, 20 realistic, 10 trap with 60 secrets.
• 2. Run each scanner (Gitleaks, TruffleHog, DotGuard) three times with default configs, record median results.
• 3. Compare detection counts, false positives, runtime, and history handling.
• 4. Analyze strengths: Gitleaks balanced, TruffleHog verifies, DotGuard fastest and cleanest JSON report.
• 5. Decide tool mix: Gitleaks in pre‑commit, DotGuard in CI, TruffleHog nightly for verification.
• 6. Implement CI steps: Gitleaks action, DotGuard npm install + scan, TruffleHog action with scopes.

证据

TruffleHog found all 60. 41 of the 60 came back as verified.

来源

DotGuard found 58 and reported zero false positives on this set.

来源

Median runtimes across the 50 repos: DotGuard 47s, Gitleaks 4m32s, TruffleHog 11m08s.

来源