CodeQL vs TruffleHog

From $30 per committer/month (GitHub Advanced Security, indicative)

Free tier available

Free on public repos. Private repositories require GitHub Advanced Security, priced per active committer.

Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.

Free for public repositories on GitHub.

Open-source CLI is free and fully functional including verification.

Widely used

GitHub (Microsoft) · since 2019

Widely used

Truffle Security · since 2016

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• Live verification cuts false positives to near zero for supported providers.
• Free and easy to add as a pre-commit hook or CI step.
• Scans far beyond git — buckets, images, logs.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

• No dashboard or workflow in the free CLI.
• Verification requires outbound network calls, which some environments block.
• Full-history scans on large repositories are slow.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.

Teams that want free, high-signal secret scanning in the pipeline today.