Betterleaks
A free, open-source scanner that catches API keys and passwords accidentally committed to your code — built by the same developer who created the widely-used Gitleaks, after he lost control of that project's name.
🔗 Visit Betterleaks
Description
Almost 29 million secrets — API keys, database passwords, tokens — got accidentally committed to public GitHub repos in a single recent year, and once a secret is in git history it's effectively public forever unless something catches it first. Betterleaks is built to be that catch: it scans repositories, files and even S3 buckets for exposed credentials before or after they leak, and can actively check whether a found secret is still valid rather than just flagging a pattern match.
Betterleaks is an MIT-licensed, open-source secrets scanner offering Expr-based contextual filtering (rules based on git author, commit message, file path), asynchronous validation that confirms whether a discovered credential is actually active, BPE-tokenization-based filtering to cut down false positives from natural language, support for scanning GitHub, GitLab, Hugging Face, S3 and local repos, and fast parallel scanning via Aho-Corasick keyword filters and the re2 regex engine. It launched February 2026 as a drop-in replacement for Gitleaks (same CLI flags and config format), is sponsored by Aikido Security, and had reached 1,528 GitHub stars by July 2026.
💬 Our review
The short version: Betterleaks is a genuinely credible successor to Gitleaks — built by the same author, drop-in compatible, and free — with the validation feature (checking if a leaked secret is actually still active) being the most useful addition over the original tool.
The backstory matters here: Gitleaks became one of the most-used secret scanners in the industry (26M+ downloads) before its creator lost control of the repository and name, so Betterleaks isn't a random fork but the original author rebuilding with what he'd learned, sponsored by Aikido Security rather than run solo. The active-validation feature is the standout practical improvement — a static regex match tells you "this looks like an AWS key," but Betterleaks can tell you whether that key still works, which is the difference between noise and an actual incident. Being a pure drop-in replacement (same flags, same config) means teams already using Gitleaks in CI/CD can switch with essentially zero migration cost. It's young (launched February 2026), so long-term maintenance commitment is still unproven, though the author's track record with Gitleaks and Aikido's backing are reassuring signals. Strong default choice for any team scanning for leaked secrets in CI/CD, especially existing Gitleaks users; there's little reason to prefer the original Gitleaks over this given the same author built both.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit, licence MIT, auto-hébergeable (CLI installable via brew, dnf, Docker, Go install).
Pros
Construit par le créateur original de Gitleaks, remplacement direct (mêmes flags/config)
Validation active : vérifie si un secret trouvé est encore valide, pas juste un pattern match
1528 étoiles GitHub en quelques mois, soutenu par Aikido Security
Scanne GitHub, GitLab, Hugging Face, S3 en plus des dépôts locaux
Cons
Produit jeune (lancé février 2026), pérennité à confirmer sur la durée
Communauté encore plus petite que Gitleaks historiquement
Migration depuis Gitleaks nécessite quand même une vérification, malgré la compatibilité annoncée
Pas d'interface graphique — outil CLI uniquement