# Tartufo vs Whispers

| Attribute | Tartufo | Whispers |
|---|---|---|
| **Vioscale score** | 37.8 (32% (low)) | 66 (13% (low)) |
| activity.commits_last_30d | 0 | - |
| adoption.dependent_repos | 3 | 0 |
| adoption.github_stars | 517 | 505 |
| deployment.options | `{"self_hosted":true}` | `{"cloud":true,"self_hosted":true}` |
| description.long | Tartufo searches through git repositories to find high entropy strings and secrets that may have been accidentally committed, helping developers identify potential security risks deep in their version control history. | A security-focused command-line tool that scans various file formats (YAML, shell scripts, Python, configuration files) to identify embedded passwords, API tokens, AWS keys, and other hardcoded secrets. It can be run independently or integrated into CI/CD pipelines. |
| integrations.count | 1 | - |
| integrations.list | `[{"name":"pre-commit"}]` | - |
| language.primary | Python | Python |
| license.spdx | GPL-2.0 | Apache-2.0 |
| market.availability | `{"hqCountry":"US","primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | `{"hqCountry":"GB","primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` |
| platform.support | `{"cli":true,"mac":true,"linux":true,"windows":true}` | `{"cli":true}` |
| pricing | `{"type":"open_source","sourceUrl":"https://github.com/pricing","retrievedAt":"2026-08-19T21:37:59.570Z"}` | `{"type":"open_source","plans":[{"free":true,"name":"Open Source","summary":"Free, open source","features":["CLI usage","CI/CD pipeline integration","Detects passwords, API tokens, AWS keys, sensitive files","Supports YAML, conf/ini, Dockercfg, shell scripts, Python3","Configurable rules and filters","Custom rule support"],"contactSales":false}],"summary":"Free, open source","freeTier":true,"sourceUrl":"https://github.com/pricing","retrievedAt":"2026-08-19T21:37:31.942Z"}` |
| pricing.free_tier | - | yes |
| pricing.model | commercial | commercial |
| pricing.price_level | free | free |
| pricing.transparent | yes | yes |
| release.cadence_days | 35 | 6 |
| release.history | `[{"url":"https://github.com/godaddy/tartufo/releases/tag/v6.0.0","date":"2025-11-04T17:31:21Z","type":"stable","version":"v6.0.0"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v5.0.2","date":"2024-10-17T23:16:06Z","type":"stable","version":"v5.0.2"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v5.0.1","date":"2024-07-26T13:27:30Z","type":"stable","version":"v5.0.1"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v5.0.0","date":"2024-03-14T21:30:15Z","type":"stable","version":"v5.0.0"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v4.1.0","date":"2023-04-03T20:45:09Z","type":"stable","version":"v4.1.0"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v4.0.1","date":"2023-03-01T21:01:54Z","type":"stable","version":"v4.0.1"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v4.0.0","date":"2023-01-17T23:18:37Z","type":"stable","version":"v4.0.0"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.3.1","date":"2022-11-23T22:04:17Z","type":"stable","version":"v3.3.1"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.3.0","date":"2022-11-23T00:35:22Z","type":"stable","version":"v3.3.0"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.2.1","date":"2022-07-20T18:32:33Z","type":"stable","version":"v3.2.1"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.2.0","date":"2022-07-06T19:57:46Z","type":"stable","version":"v3.2.0"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.1.4","date":"2022-05-31T23:25:41Z","type":"stable","version":"v3.1.4"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.1.3","date":"2022-04-04T23:36:35Z","type":"stable","version":"v3.1.3"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.1.2","date":"2022-03-28T22:43:26Z","type":"stable","version":"v3.1.2"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.1.1","date":"2022-03-25T15:32:19Z","type":"stable","version":"v3.1.1"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.1.0","date":"2022-03-24T21:30:25Z","type":"stable","version":"v3.1.0"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.0.0","date":"2022-01-05T22:56:38Z","type":"stable","version":"v3.0.0"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v2.10.1","date":"2021-12-27T20:33:47Z","type":"stable","version":"v2.10.1"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.0.0-rc.3","date":"2021-12-13T21:58:57Z","type":"prerelease","version":"v3.0.0-rc.3"},{"url":"https://github.com/godaddy/tartufo/releases/tag/v3.0.0-rc.2","date":"2021-12-10T00:58:17Z","type":"prerelease","version":"v3.0.0-rc.2"}]` | `[{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.5.3","date":"2021-08-25T20:08:40Z","type":"stable","version":"1.5.3"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.5.2","date":"2021-08-25T18:33:23Z","type":"stable","version":"1.5.2"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.5.1","date":"2021-08-18T22:56:45Z","type":"stable","version":"1.5.1"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.5.0","date":"2021-08-18T21:33:41Z","type":"stable","version":"1.5.0"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.9","date":"2021-05-31T20:32:26Z","type":"stable","version":"1.4.9"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.8","date":"2021-04-19T16:09:58Z","type":"stable","version":"1.4.8"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.7","date":"2021-03-23T20:48:34Z","type":"stable","version":"1.4.7"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.6","date":"2021-03-22T12:05:27Z","type":"stable","version":"1.4.6"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.5","date":"2021-03-18T18:08:22Z","type":"stable","version":"1.4.5"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.4","date":"2021-03-06T00:06:32Z","type":"stable","version":"1.4.4"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.3","date":"2021-03-01T11:22:24Z","type":"stable","version":"1.4.3"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.2","date":"2021-02-16T12:06:51Z","type":"stable","version":"1.4.2"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.1","date":"2021-02-02T18:38:41Z","type":"stable","version":"1.4.1"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.4.0","date":"2021-01-27T17:28:53Z","type":"stable","version":"1.4.0"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.3.12","date":"2021-01-21T17:19:15Z","type":"stable","version":"1.3.12"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.3.11","date":"2021-01-20T15:44:53Z","type":"stable","version":"1.3.11"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.3.10","date":"2021-01-19T20:39:31Z","type":"stable","version":"1.3.10"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.3.9","date":"2021-01-08T17:42:58Z","type":"stable","version":"1.3.9"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.3.8","date":"2020-12-16T19:49:24Z","type":"stable","version":"1.3.8"},{"url":"https://github.com/Skyscanner/whispers/releases/tag/1.3.7","date":"2020-12-01T01:20:33Z","type":"stable","version":"1.3.7"}]` |
| security.scorecard | 5.6 | - |
| security.vulnerabilities | `{"count":0,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=pypi&package_name=tartufo&per_page=100","last_12m":0,"max_severity":null}` | `{"count":0,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=nixpkgs&package_name=whispers&per_page=100","last_12m":0,"max_severity":null}` |

## Capabilities (Secrets Scanning)

| Capability | Tartufo | Whispers |
|---|:--:|:--:|
| **Capabilities** |  |  |
| Deployment model | - | - |
| Git repository historical scanning | - | - |
| Pre commit developer hooks | - | - |
| Active token validation engine | - | - |
| High entropy regex detection | - | - |
| Slack teams jira scanning | - | - |
| Automated key revocation apis | - | - |
| Custom regex rules support | - | - |
| Ci cd pipeline build blocking | - | - |
| Compliance audit reporting | - | - |
| SOC2 type ii | - | - |
| ISO 27001 | - | - |
| Pricing model | - | - |

*Source: Vioscale. Generated 2026-09-01T17:22:02.443Z. "-" = undocumented, not absent.*