TruffleHog vs CodeQL

Free tier available

From $30 per active committer/month (GitHub Code Security)

Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.

Free on public repos. For private repositories GitHub split Advanced Security into two products in April 2025: Code Security at $30 and Secret Protection at $19 per active committer/month, both now available on Team plans as well as Enterprise. CodeQL sits in Code Security. Billing counts active committers, not seats, which can surprise teams with many occasional contributors.

Open-source CLI is free and fully functional including verification.

Free for public repositories on GitHub.

Widely used

Truffle Security · since 2016

Widely used

GitHub (Microsoft) · since 2019

• Live verification cuts false positives to near zero for supported providers.
• Free and easy to add as a pre-commit hook or CI step.
• Scans far beyond git — buckets, images, logs.

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• No dashboard or workflow in the free CLI.
• Verification requires outbound network calls, which some environments block.
• Full-history scans on large repositories are slow.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

Teams that want free, high-signal secret scanning in the pipeline today.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.