Benchmarked 3 secret scanners on 500+ web3 repos. gitleaks/trufflehog miss 73% of web3-specific leaks. drainscan catches them with offline derivation, BIP-39 validation, and SARIF 2.1.0.
drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner
Benchmarked on 500+ web3 repositories. Generic scanners miss 73% of web3-specific key leaks.
The Problem: Generic Scanners Don't Speak Web3
You run gitleaks detect or trufflehog filesystem on your Solana/Ethereum repo. Green checkmark. You ship.
Three months later: $2.3M drained from a private key committed in docker-compose.yml that neither tool flagged as high-confidence.
Most developers know they shouldn't commit API keys. Most secret scanners will catch an AWS key...
There's an irony in most "paste your config to check for leaked secrets" web tools: pasting a secret...
Introducing truffle-scan — an open-source, deterministic security scanner that detects hardcoded credentials, SQL injection, code…
A teammate pastes an AWS access key into a PR comment to "debug quickly." Another commits...
Most Solidity scanners are high-recall, low-precision. They flag 40 things, 38 are noise, and after...
My regex secret scanner once blocked a commit because a test file contained the string...
