Talisman review
A free local scanner for catching secrets before commits, pushes, and history sharing.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Talisman is an open-source secrets-scanning utility from ThoughtWorks for developers and teams that want local checks around Git activity. It installs Git hooks to inspect outgoing changesets for potential secrets and sensitive information, including authorization tokens, SSH keys, private keys, suspicious filenames, encoded values, high-entropy content, and credit-card numbers. It supports Git on macOS, Linux, and Windows, and can also scan repository history from the command line. For teams prioritizing free, developer-controlled protection before code leaves a workstation, Talisman is a focused fit.
Its strongest area is detection depth within a local Git workflow. Talisman supports pre-commit and pre-push scanning, repository history scanning, custom regular-expression search patterns, ignored files, detector severity settings, and configurable severity thresholds. Detection can consider file contents, filenames, entropy, file size, encoded values, and payment-card numbers. HTML reporting adds a shareable output format for scan results. Integrations with pre-commit, Husky, and Homebrew help it fit common local development setups, while its support for all three major desktop operating systems broadens deployment options.
Talisman is most suitable for individuals and teams that want an open-source utility running close to the developer workflow, without a hosted commercial service or paid repository tier. Its scope is narrower than a platform built around centralized security administration, pull-request workflows, or a broader cloud-based development pipeline. Choose it when pre-commit, pre-push, and history checks are the priority, along with custom detection rules and local control. Consider an alternative if your requirements center on managed repository coverage, a hosted service, or capabilities beyond Git hooks and command-line history scanning.
Talisman pros and cons
- Where it wins
- Covers pre-commit, pre-push, and repository history scanning
- Detects encoded values, entropy, filenames, payment cards, and custom patterns
- Runs on macOS, Linux, and Windows with configurable severity thresholds
- Where it doesn't
- Focuses on Git workflows rather than a hosted scanning service
- Does not list a paid tier or hosted repository-management features
- Its integrations are limited to pre-commit, Husky, and Homebrew
Talisman fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update