Gitleaks
An open-source command-line tool that scans git repositories, files and history for hardcoded secrets. Can run locally, as a pre-commit hook or in CI.
Free tier
- Open source and free to run
Best for
Scanning a vibe-coded repo's full history before you make it public.
Watch out: A finding means the key may already be exposed. Rotate it at the provider; deleting it from the latest commit is not enough.
Related fix guides
Sources
Checked on 2026-11-11. Vendors change pricing often, so confirm on the official page before you commit.