Why This Review Exists

Most "best security tools" lists are affiliate roundups. This one is an honest field guide. We are a security company with a specific product (AI proxy mutation) and a specific gap we fill. Every tool listed here does something outside our scope. Some of them you should use alongside Pretense. All of them are worth knowing.

The organizing principle: every tool here operates on static code or git history. Pretense operates at the AI API boundary, at the moment code is transmitted to an external LLM. They are complementary layers that work together.

---

Gitleaks

What it does: Scans git repositories (including full history) for secrets, credentials, and tokens. Supports 150+ secret patterns out of the box.

Install time: Under 5 minutes.

# Install via Homebrew
brew install gitleaks

# Scan current repo
gitleaks detect --source=. --verbose

# Scan full git history
gitleaks detect --source=. --log-opts="--all"

# As a pre-commit hook
gitleaks protect --staged

False positive rate: Low to medium. Gitleaks is conservative by default and has good entropy-based filtering. The main false positive source is test fixture files that contain mock credentials.

What it catches: AWS keys, GitHub tokens, Stripe secrets, Slack webhooks, JWT secrets, private keys, and over 150 other patterns. Catches secrets that were committed and deleted (via history scan).

Blind spots: It covers what lands in git. Secrets that live elsewhere fall outside its view: environment variables in developer shells, secrets pasted into AI prompts, or credentials held in developer memory that stay off disk.

Verdict: Install on every project. Add the pre-commit hook. Run the history scan on any repo that is more than six months old. You will likely find something.

---

Semgrep

What it does: Static analysis security testing (SAST) with a rule-based engine. Matches code patterns across the entire project, well beyond secrets. Catches SQL injection patterns, XSS vectors, insecure deserialization, and hundreds of other vulnerability classes.

Install time: Under 10 minutes including a first scan.

# Install
pip install semgrep

# Run the security audit ruleset
semgrep --config=p/security-audit .

# Run for TypeScript/JavaScript
semgrep --config=p/typescript .

# Run for Python
semgrep --config=p/python .

False positive rate: Medium. Semgrep rules vary widely in quality. The maintained rulesets (p/security-audit, p/owasp-top-ten) are well-tuned. Custom rules can produce significant noise.

What it catches: Known vulnerable patterns: unvalidated input passed to SQL queries, secrets hardcoded in source files, use of deprecated cryptographic functions, prototype pollution patterns, path traversal vectors.

Blind spots: Business logic vulnerabilities, authorization flaws (is this user allowed to access this resource?), and anything that requires understanding the application's data flow at runtime.

Verdict: Run Semgrep in CI on every pull request. The security-audit ruleset is worth the noise for the findings it surfaces. Exhaust the maintained rulesets first, then write custom rules.

---

Trivy

What it does: Container and dependency vulnerability scanner. Scans Docker images, Kubernetes manifests, Terraform configurations, and package lock files for known CVEs.

Install time: Under 5 minutes.

# Install via Homebrew
brew install trivy

# Scan a Docker image
trivy image node:20-alpine

# Scan filesystem (catches package.json, requirements.txt, etc.)
trivy fs .

# Scan Kubernetes manifest
trivy k8s --report summary cluster

# Scan Terraform config
trivy config ./terraform/

False positive rate: Low. Trivy matches against the NVD (National Vulnerability Database) and GitHub Advisory Database, so findings are verified CVEs with known severity ratings.

What it catches: Outdated packages with known vulnerabilities, misconfigured container images, insecure Kubernetes configurations, exposed ports, and privilege escalation paths in infrastructure-as-code.

Blind spots: Zero-day vulnerabilities (by definition), configuration issues that are organization-specific, and anything requiring runtime analysis.

Verdict: Run Trivy in CI on every Docker build and on every pull request that touches infrastructure configuration. The container scanning is particularly valuable for catching base image vulnerabilities that developers rarely think about.

---

detect-secrets

What it does: Pre-commit hook and CI scanner for secrets. Maintains a baseline file of acceptable false positives, making it more manageable than tools that produce noise in well-established codebases.

Install time: Under 5 minutes.

# Install
pip install detect-secrets

# Create a baseline (scan existing codebase, mark known false positives)
detect-secrets scan > .secrets.baseline

# Audit the baseline to mark false positives
detect-secrets audit .secrets.baseline

# Run as pre-commit hook (prevents new secrets from being committed)
detect-secrets scan --baseline .secrets.baseline

False positive rate: Low after baseline is established. The baseline approach is the key differentiator: you audit the initial findings once, mark the test fixtures and mock credentials as false positives, and subsequent scans only flag new findings.

What it catches: Similar pattern to Gitleaks: API keys, tokens, credentials, private keys, password assignments. The baseline approach makes it more practical for existing projects.

Blind spots: Same as Gitleaks: runtime secrets, secrets in AI prompts, environment variables that stay out of files.

Verdict: Use detect-secrets if you have an existing codebase with pre-existing false positives that make zero-tolerance tools impractical. The baseline model makes adoption easier for mature projects.

---

truffleHog

What it does: Deep git history scanner with entropy analysis and verified scanning. Sends potential secrets to the issuing service to verify if they are active credentials (with your permission).

Install time: Under 5 minutes.

# Install via Homebrew
brew install trufflehog

# Scan git history
trufflehog git https://github.com/your-org/your-repo

# Scan local filesystem
trufflehog filesystem /path/to/project

# Scan Docker image
trufflehog docker --image=your-image:tag

# Only verified secrets (reduces noise significantly)
trufflehog git --only-verified https://github.com/your-org/your-repo

False positive rate: Medium by default, low with --only-verified. The verified scanning feature is the key differentiator: truffleHog can confirm whether a found API key is still active by making a test request to the relevant service. This dramatically reduces noise.

What it catches: Everything Gitleaks catches, plus historical commits that were squashed or rebased out of the main branch, and credentials in submodules.

Blind spots: The same class of gaps as all git-based scanners: runtime secrets and AI prompt exfiltration.

Verdict: Run truffleHog with --only-verified on repositories before open-sourcing them or before security audits. The verified scanning is worth the slightly higher runtime compared to Gitleaks.

---

Pretense

What it does: Intercepts outbound LLM API requests on your machine and swaps proprietary code identifiers and detected secrets for deterministic stand-ins before they leave your network. Operates at the AI API boundary.

Install time: Under 5 minutes.

# Install and start
curl -fsSL https://pretense.ai/install.sh | sh
pretense init
pretense start

# Route Claude Code through Pretense
export ANTHROPIC_BASE_URL=http://localhost:9339

False positive rate: Near zero. Mutation keeps all code in place and replaces identifier names with deterministic synthetics. The LLM receives structurally equivalent code and produces useful output, and identifiers are swapped back byte-exact in the answer.

What it catches: Proprietary function names, class names, variable names, and API surface area transmitted to LLM providers. Also catches secrets matching 30+ patterns and swaps them for stand-in tokens before transmission; those stay as stand-ins in the answer by design. Emails and phone numbers are flagged by default.

Blind spots: Freeform natural language prompts referencing proprietary names, commit messages, file paths, and anything outside code blocks.

Verdict: Complementary to all tools above. The other tools secure your codebase and dependencies. Pretense secures the moment your code is transmitted to an AI API. They address different attack surfaces.

---

The Layered Stack

A complete AI-era security stack looks like this:

These tools overlap very little. All four are worth running. The total overhead for a 10-person team is approximately 2 hours of initial setup and under 30 minutes per week of CI/CD review time.

How I run Pretense on my own code

I build Pretense with Claude Code, and my sessions run through it. Here is the setup I give a new engineer, in order.

1. -Run the agent through the proxy. Type pretense run claude where you would type claude. It starts a local proxy on port 9339, points Claude Code at it and stops the proxy when the session ends. Detected secrets and PII leave the laptop as stand-in tokens.
2. -Put hooks on every repo. pretense install adds a pre-commit and a pre-push hook. A key that never lands in git is a key an agent never reads.
3. -Scan before an agent reads the repo. pretense scan path . lists what it finds. In CI, pretense scan ci exits 0 when clean, 2 on findings and 3 when it examined nothing. Treat 3 as a failure.
4. -Preview the swap. pretense review . shows what would be mutated. pretense mutate <file> --preview prints one file mutated and leaves the file on disk as it was.
5. -Round-trip a file you need to share. pretense mutate <file> --map <map> swaps the secrets in place. pretense reverse <file> --map <map> turns it back into the original, byte for byte, from the encrypted map on your machine. We run that round trip on real files before every CLI release and compare sha256 hashes.

One thing I learned the hard way: inside a session the agent sees stand-ins, so a file the agent writes can hold a stand-in where you expected a real value. Grep what the agent wrote before you ship it.

What Pretense will not do is put a secret back into the model's answer. Code identifiers come back byte-exact. Secrets and PII stay as stand-ins in the response. That is deliberate: a prompt-injected model can echo a token into a link, and reversing it there would hand over the real key.

What this means if you buy security

The outcome: your engineers keep their AI coding tools, and detected secrets and PII leave each laptop as stand-in tokens.

• -The control sits on the endpoint. The swap runs on the developer's machine before the request leaves. No shared gateway holds every team's keys.
• -You get evidence, not a memo. pretense audit --format csv exports every mutation event. Add --framework SOC2 to keep only the events that map to that framework.
• -Check it on your own code. Detection is pattern and entropy based, and coverage varies by data type. Run pretense review . on a real repo and read what it catches before you sign off.
• -Start with one team. One repo, pretense run claude, one week. Then read the audit log with the team lead.

Try it on your own repo: create a free account, then run npm i -g @pretense/cli and pretense run claude. If you need a security review first, talk to me.