Stack Gems
Menu
WorkbenchBestNewSkillsLogAboutSubmit

Alternatives · Security

Gitleaks alternatives (2026)

Gitleaks: MIT secrets CLI. Free forever; org Action wants free license key.

Its Catch: Maintainer marks feature-complete (security patches; focus shifting to Betterleaks).

Below: 8 free or free-tier tools from the same category (security tools), free and open source first, then the closest match by shared tags. Each keeps its own Catch.

  1. 1.GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI

    Free / OSS · Apache-2.0 · 13k GitHub stars

    VerdictApache-2.0 SBOM vuln scanner. Free CLI; Enterprise is the paid cousin.

    CatchVuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.

  2. 2.SOPSMPL-2.0 encrypts config values; keys stay readable

    Free / OSS · MPL-2.0 · 23.4k GitHub stars

    VerdictMPL-2.0 secrets-in-git. Free forever; use age underneath when you want KMS-free recipients.

    CatchVs age (file encryption) and Infisical (secrets product): SOPS is the *structured config encryptor*, not a password manager and not a hosted vault UI. You still design key distribution, rotation, and who can decrypt in CI. Binary mode encrypts whole files when structure does not apply.

  3. 3.SyftApache-2.0 SBOM CLI for images and filesystems (pairs with Grype)

    Free / OSS · Apache-2.0 · 9.7k GitHub stars

    VerdictApache-2.0 SBOM CLI. Free forever; generate the bill, then let Grype/Trivy argue about CVEs.

    CatchVs Grype (vuln *scan* from SBOMs/images) and Trivy (broader scanner): Syft is the *SBOM producer*, not the CVE verdict engine. Format choice and package coverage still need CI wiring; it does not replace signed attestations (cosign) or policy gates by itself.

  4. 4.OSV-ScannerApache-2.0 OSV.dev vulnerability scanner for lockfiles and images

    Free / OSS · Apache-2.0 · 11.2k GitHub stars

    VerdictApache-2.0 OSV.dev scanner. Free forever; pair with Trivy/Grype/Syft, do not clone them.

    CatchVs Trivy/Grype (broader/image-first scanners) and Syft (*SBOM producer*): OSV-Scanner is the OSV.dev-native vuln CLI, not a replacement for every Trivy filesystem/misconfig check and not the SBOM generator. Complements those tools; do not expect identical CVE sets. Networked API unless you go `--offline`.

  5. 5.mcp-audit-toolMIT static audit of MCP client configs — poisoning, rugs, secrets

    Free / OSS · OSS/MIT · 431 GitHub stars

    VerdictMIT MCP client-config auditor when you gate `.cursor/mcp.json` before connect — not Cisco MCP Scanner servers and not HOL Guard runtime policy.

    CatchPackage: README PyPI badge may lag — install from the MIT git repo / pipx, not the unrelated PyPI name `mcpaudit` (different project). Vs mcp-scanner / hol-guard / skillspector: MCP Scanner audits MCP servers/tools; HOL Guard is runtime local allow/block; SkillSpector gates skills — mcp-audit-tool’s catch is client-config static audit. ★ still small; pin a commit; findings are leads, not proof.

  6. 6.TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier

    Free / OSS · Apache-2.0 · 38.5k GitHub stars

    VerdictApache-2.0 security scanner. Fully free CLI; Aqua Platform is the paid cousin.

    CatchCLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.

  7. 7.CosignApache-2.0 Sigstore keyless container/artifact signing CLI

    Free / OSS · Apache-2.0 · 6.4k GitHub stars

    VerdictApache-2.0 Sigstore signing. Free CLI; policy engines are separate.

    CatchSigning CLI + public-good Sigstore infra — not a full policy admission controller (pair with Kyverno/OPA). Offline/air-gap needs different PKI. Registry must support referrers/OCI artifacts cleanly.

  8. 8.direnvMIT per-directory env loader for any shell

    Free / OSS · OSS/MIT · 15.5k GitHub stars

    VerdictMIT directory env. Free forever; allow once per project and stop polluting $PATH.

    CatchEach new .envrc needs `direnv allow`. Not a secrets vault — still files on disk.

FAQ

What are the best free alternatives to Gitleaks?
Grype, SOPS, Syft, OSV-Scanner, mcp-audit-tool. All are reviewed on Stack Gems in the same category (security tools); 8 free or open source.
What is the catch with Gitleaks?
Maintainer marks feature-complete (security patches; focus shifting to Betterleaks).
Is there an open-source alternative to Gitleaks?
Yes: Grype (Apache-2.0), SOPS (MPL-2.0), Syft (Apache-2.0), OSV-Scanner (Apache-2.0).

More