Top picks: detect-secrets, shhgit, DeepSource SAST — plus 45 more compared.
Application Securitygit-all-secrets is a free Static Application Security Testing tool. Security professionals most commonly compare it with detect-secrets. All 48 alternatives are matched by shared capabilities, tags, and NIST CSF 2.0 coverage.
A closer look at the 8 most relevant alternatives and competitors to git-all-secrets, including their key features and shared capabilities.
A pre-commit security tool that scans source code repositories to detect and prevent secrets like API keys, passwords, and credentials from being committed to version control systems.
Shares 4 capabilities with git-all-secrets: Security Scanning, DEVSECOPS, Source Code Analysis, Secret Detection
A secrets detection tool that scans GitHub, GitLab, and Bitbucket repositories to identify API keys, access tokens, and other sensitive information in source code.
Shares 4 capabilities with git-all-secrets: Security Scanning, DEVSECOPS, Source Code Analysis, Secret Detection
SAST engine that scans code commits for security vulnerabilities
Shares 3 capabilities with git-all-secrets: Security Scanning, DEVSECOPS, Source Code Analysis
Developer-first SAST tool for finding security & privacy vulns in code.
Shares 3 capabilities with git-all-secrets: DEVSECOPS, Source Code Analysis, Open Source
IaC scanner detecting misconfigs, vulnerabilities & policy violations in templates.
Shares 3 capabilities with git-all-secrets: Security Scanning, DEVSECOPS, Secret Detection
AI platform for automated code review, security risk detection across the SDLC.
Shares 3 capabilities with git-all-secrets: Security Scanning, DEVSECOPS, Source Code Analysis
AI-powered secure code platform for vulnerability detection & codebase analysis.
Shares 3 capabilities with git-all-secrets: Security Scanning, DEVSECOPS, Source Code Analysis
KICS is an open-source Infrastructure as Code security scanner that detects vulnerabilities and misconfigurations through customizable queries and integrates with CI/CD pipelines.
Shares 3 capabilities with git-all-secrets: Security Scanning, DEVSECOPS, Open Source
A pre-commit security tool that scans source code repositories to detect and prevent secrets like API keys, passwords, and credentials from being committed to version control systems.
A secrets detection tool that scans GitHub, GitLab, and Bitbucket repositories to identify API keys, access tokens, and other sensitive information in source code.
SAST engine that scans code commits for security vulnerabilities
Developer-first SAST tool for finding security & privacy vulns in code.
IaC scanner detecting misconfigs, vulnerabilities & policy violations in templates.
AI platform for automated code review, security risk detection across the SDLC.
AI-powered secure code platform for vulnerability detection & codebase analysis.
KICS is an open-source Infrastructure as Code security scanner that detects vulnerabilities and misconfigurations through customizable queries and integrates with CI/CD pipelines.
Betterscan is an orchestration toolchain that coordinates multiple security tools to scan source code and infrastructure as code for security vulnerabilities, compliance risks, secrets, and misconfigurations.
ASH is an automated security scanning tool that integrates multiple open-source security scanners to perform preliminary security checks on code, infrastructure, and IAM configurations during development.
DumpsterDiver analyzes large datasets to detect hardcoded secrets, keys, and passwords using entropy calculations and customizable search rules.
AI-powered SAST tool that finds and auto-fixes code vulnerabilities in real-time
Code quality and security platform with SAST, SCA, and AI-powered remediation
SAST solution that scans 30+ languages to find and fix code vulnerabilities
An application security platform that combines multiple security scanners including SAST, SCA, container security, and compliance reporting with CI/CD integration capabilities.
IDE plugin for SAST and SCA scanning with real-time vulnerability detection
AI-powered AppSec platform with agentic agents for vulnerability prevention & fix
SAST tool that identifies security and quality issues in source code
Code security platform with SAST, SCA, IAST, and IaC security capabilities
SAST tool for identifying security vulnerabilities in source code
Scans code repositories and runtime environments for exposed secrets and credentials
App security testing platform with SAST, SCA, secrets detection, and IaC scanning
Detects secrets and credentials in code using AI/ML and Code Property Graph
Continuous AppSec testing platform with zero-touch provisioning for CI/CD
SAST scanner for identifying security vulnerabilities in source code
Scans and detects hardcoded secrets across SDLC and dev tools
SAST tool that identifies vulnerabilities in source code across 30+ languages
SAST tool for finding code quality & security defects in large-scale software
Scans source code repositories for exposed secrets and sensitive data
Prevents secrets & sensitive data leaks in code at source
Source code malware scanner detecting backdoors and malicious code in repos
Continuous secret scanning and leak detection tool with precommit checks
SAST platform that runs scans and ingests SARIF results into a unified dashboard.
AI-powered AppSec platform for code, supply chain, secrets & DAST.
IDE-native guardrails that enforce security rules on AI-generated code in real time.
A secret scanning tool that examines NPM modules and ZIP files for exposed credentials and sensitive information using nuclei templates.
Open-source CLI tool for privacy code scanning and data flow analysis.
Bearer CLI is a static application security testing tool that scans source code across multiple programming languages to identify and prioritize OWASP Top 10 and CWE Top 25 security vulnerabilities through data flow analysis.
Insider is an open-source CLI tool that performs static source code analysis to detect OWASP Top 10 vulnerabilities across multiple programming languages including Java, Kotlin, Swift, .NET, C#, and JavaScript.
cfn-nag is a static analysis tool that scans AWS CloudFormation templates to identify security vulnerabilities and misconfigurations in infrastructure-as-code.
AI-native SAST tool providing contextual code security analysis in pull requests
Automated vulnerability remediation tool that fixes code security issues
AI-powered automated code security remediation bot for vulnerability fixes
Scans IaC files for misconfigurations before deployment to production.
DevSecOps platform for vulnerability detection and developer security training
Automated app security testing platform for Salesforce and B2C Commerce
AI-powered code analysis platform for security, quality, and developer insights
Detects and prevents secrets leakage across the software development lifecycle
Common questions security professionals ask when evaluating alternatives and competitors to git-all-secrets.
The most popular alternatives to git-all-secrets include detect-secrets, shhgit, DeepSource SAST, Bearer, and Meterian ISAAC. These Static Application Security Testing tools offer similar capabilities and are frequently compared by security professionals evaluating their options.
