Tag
Secrets
4 reviewed tools: 3 free or open source, 1 hosted with a real free tier.
Order: free and open source first, then hosted products with a real free tier, then paid-led; catalog order inside each group, with quiet or archived repos last. Not a score, and no tool pays for its place.
4 tools
- OpenBaoMPL-2.0 Vault-compatible secrets engine after the Vault fork
Free / OSS · MPL-2.0 · 8.6k GitHub stars
VerdictMPL Vault-compat engine. Fork for license, not Infisical DX.
CatchVault-engine / IdP-secrets lane, not Infisical app-secrets DX. This is the engine/compat fork, not the developer-secrets UI. Don’t assume a Cloud free tier.
- GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key
Free / OSS · OSS/MIT · 30.2k GitHub stars
VerdictMIT secrets CLI. Free forever; org Action wants free license key.
CatchMaintainer marks feature-complete (security patches; focus shifting to Betterleaks). Official Action for GitHub org repos needs a free license key from gitleaks.io — personal accounts exempt. Not a full ASVS/SAST suite. False positives need allowlists.
- TruffleHogAGPL-3.0 secret scanner that finds leaked credentials and checks whether they still work
Free / OSS · AGPL-3.0 · 28.6k GitHub stars
VerdictThe scanner to run when you need to know which leaked keys are live — mind the AGPL and the outbound verification calls.
CatchLicense first: AGPL-3.0 is copyleft, not permissive — check it with your legal team before embedding or modifying it in a product you distribute or offer as a service. Verifying a secret calls the real provider’s API with it, so scans make outbound requests and show up in that provider’s logs. Continuous monitoring of Slack, Jira, Confluence and similar tools is in the paid Enterprise product; the open-source CLI covers one-off and CI scans. Vs gitleaks (MIT, fast regex scanning, no live verification): TruffleHog tells you which leaks still work, at the cost of a copyleft license and network calls.
- InfisicalMIT secrets; Cloud Free forever 5 identities; ee/ needs LICENSE_KEY
Free tier · Freemium · 29.9k GitHub stars
VerdictMIT secrets with a real Free forever Cloud hatch. ee/ is the paid carve-out.
Catchee/ needs LICENSE_KEY even self-hosted (SSO+, versioning, rotation, dynamic secrets) — authentik enterprise pattern. Stretch: secrets remit. Distinct from authentik (IdP) and from Vault-scale ops.
FAQ
- What is the top free pick among Secrets?
- OpenBao leads the Stack Gems list for Secrets. Verdict: MPL Vault-compat engine. Fork for license, not Infisical DX.
- How many Secrets does Stack Gems review?
- 4: 3 free or open source, 1 hosted with a real free tier. Each review has a verdict and an honest Catch; no tool pays for its spot.
- Which Secrets can I self-host for free?
- OpenBao, Gitleaks and TruffleHog.
- Which Secrets have the most GitHub stars?
- Gitleaks (30.2k), Infisical (29.9k), TruffleHog (28.6k), per GitHub on 2026-10-21. Stars measure attention, not fit; read the Catch.
- What is the catch with OpenBao?
- Vault-engine / IdP-secrets lane, not Infisical app-secrets DX.