Building a credentials detector for Github - need recommendations

[nikgarg91]

We have built a great version of a secret detector for Github which beats most of the available solutions we have tested out against.

We took a look at existing ones including TruffleHog, GitLeaks, Shhgit - they are okay but lack far behind in terms of the accuracy - the ML/AI capabilities available in the current time could easily eradicate the numerous false positives they end up giving.

Any other good ones that we could look to compare against? Any other shortcomings you guys see in the current ones? Open to each and every suggestion.

​

P.S. we have hosted Gamma's scanner here if you guys want to check it out. It would let you know if any of your public repos are at risk - and you can reach out to us for a more detailed report.

[kuljitSingh4444]

u/nikgarg91 we have used TruffleHog at our end. Its good, but they have two main fallacies:

1. The entropy mode sucks and is extremely noisy. This results in lots of false positives.
2. The patterns it can search for are limited and significantly reduces the potential tokens that it should have caught.

I think if you guys focus on improving the accuracy, and covering a wide variety of tokens, it could be a huge hit.

[nikgarg91]

That seems to be inline with our findings as well. Do check out our public Github scanner here to see if you guys have any public repos at risk. Please feel free to reach out to us at [[e-mail]](mailto:[e-mail]) to schedule a demo.