Is there a respected tool for scanning source code for passwords, private keys, API tokens, or such?

@liw

Trufflehog?

https://github.com/trufflesecurity/trufflehog

@werdahias Can you provide a link to more information about that?

@liw Gitleaks is working well for us

https://github.com/gitleaks/gitleaks

@liw I see that other replies have already mentioned my top three recommendations (git-secrets, gitleaks, and trufflehog). I would only add https://github.com/advanced-security/secret-scanning-custom-patterns/ , which GitHub insists is _not_ exactly equivalent to the list of patterns they use for their GitHub Advanced Security Secret Scanning service offering². (This is not a tool per se, it's a list of categorized regex patterns that you could feed into e.g. `git cat-file --batch-all-objects ... | fgrep ...`)

²: https://docs.github.com/en/code-security/secret-scanning/working-with-secret-scanning-and-push-protection