TruffleHog vs Veracode

Free tier available

Quote on request

Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.

Enterprise annual subscriptions priced by application count and scan types.

Open-source CLI is free and fully functional including verification.

No free tier.

Widely used

Truffle Security · since 2016

Widely used

Veracode · since 2006

• Live verification cuts false positives to near zero for supported providers.
• Free and easy to add as a pre-commit hook or CI step.
• Scans far beyond git — buckets, images, logs.

• Binary scanning works on third-party and supplier software where source is unavailable.
• Policy engine and attestation reports satisfy regulated procurement directly.
• Managed service model suits organisations without a security engineering team.

• No dashboard or workflow in the free CLI.
• Verification requires outbound network calls, which some environments block.
• Full-history scans on large repositories are slow.

• Slow feedback compared with developer-first tools — poor fit for per-commit scanning.
• Expensive per application.
• Developer experience lags Snyk and Semgrep considerably.

Teams that want free, high-signal secret scanning in the pipeline today.

Regulated enterprises needing formal security attestation, including for supplier software.