Find. Verify. Revoke.

Most scanners hand you a list of regex matches. pleno-dlp confirms each leak with the issuing provider — and can kill it. 619 detector types, 28 sources, one static Go binary.

$ go install github.com/plenoai/pleno-dlp/cmd/pleno-dlp@latest signed binaries →

Close the loop

Verification runs by default. Revocation is gated behind --confirm and only ever fires on provider-confirmed findings.

01 detect

Filesystem, git history, diffs on stdin, and seven SaaS sources.

pleno-dlp scan git --repo .
→

02 verify

552 of 619 detectors check the issuing provider's API. Confirmed = Critical.

pleno-dlp detectors list --verify-status
→

03 revoke

Invalidate confirmed leaks: GitHub, GitLab, Slack, AWS, Stripe.

pleno-dlp revoke --detector github --confirm

Signal, not a triage queue

Placeholders and doc keys are suppressed before you see them. Raw secrets are never printed — findings carry a stable secret_hash.

zsh — pleno-dlp
$ pleno-dlp scan git --repo . --max-depth 200
scanned 1378 chunk(s), 5285980 byte(s), 3 finding(s) in 362ms
placeholder: suppressed 47 finding(s)
DETECTOR  VERIFIED  LOCATION                       REDACTED
AWS       yes       config/prod.env:14             AKIA...
Stripe    yes       services/billing/client.go:88  sk_live_...
GitHub    no        scripts/old-deploy.sh:3        ghp_...

$ echo $? # exit 1 — gate your CI on it
1

Fast enough for every commit

Median wall-clock, 20 runs, 9.6 MiB clean corpus — the path every green CI run pays. Snapshot measured 2026-05-12, not live.

pleno-dlp619 detectors 118 ms
trufflehog870 detectors 1,042 ms
gitleaks222 regex rules 23 ms

Yes, gitleaks wins this corpus — with no verification, no revocation, and a quarter of the rules. Detector/rule counts measured 2026-06-10 against released tags — see docs/comparison.md. Full methodology, raw samples, and threats to validity: docs/benchmarks.md.

Every surface secrets leak to

Code is half the problem. The other half lives in chat, wikis, and tickets.

filesystem git history stdin / diffs GitHub GitLab Bitbucket Slack Notion Confluence Jira

Secrets are also only half of DLP — --pii-engine scans the same sources for names, addresses, and national IDs in the same pass.

Built like it handles secrets

Pre-commit in one line

pleno-dlp protect scans only staged added lines — history noise can't fail your hook.

SARIF → Code Scanning

--format sarif plugs into GitHub Code Scanning. --fail-on turns severity into exit codes.

Audited verify coverage

CI rejects any detector that ships unverified without a documented reason.

Open and attested

AGPL-3.0. Tag-driven releases with SLSA provenance. Race-detector clean on every merge.

Scan your repo in one command

$ go install github.com/plenoai/pleno-dlp/cmd/pleno-dlp@latest && pleno-dlp scan filesystem .