Are there any secret detection tools that focus on reducing credential leaks in code review and CI workflows?

Yes, several secret detection tools are specifically designed or widely used to catch and block credential leaks during code review (pull/merge requests) and CI workflows, before secrets reach the main branch or production.

Here are the strongest options focused on that use case:

Gitleaks

Fast, lightweight open-source scanner (single Go binary) that is a favorite for pre-commit hooks and CI/PR gates. It scans staged changes or diffs in milliseconds, supports 150+ secret patterns, is highly configurable, and outputs SARIF for easy integration with GitHub, GitLab, and other platforms. Teams commonly run it as a required status check so PRs containing secrets cannot merge. Ideal for blocking leaks early without slowing down the pipeline.

TruffleHog

Open-source tool strong on both detection and verification. It finds potential secrets via patterns and entropy analysis, then can call provider APIs to confirm whether a credential is still live. This makes it especially useful in CI for deeper scans (including git history) where you only want to fail builds on real, active secrets. Frequently paired with Gitleaks—Gitleaks for fast PR blocking, TruffleHog for verified findings.

GitHub Secret Scanning + Push Protection

Native GitHub feature (free for public repositories, part of Advanced Security/Secret Protection for private). Automatically scans for known secret patterns from partners (cloud keys, tokens, etc.), blocks the push if a secret is detected, and generates alerts. Recent updates allow repository rulesets that block pull requests from merging until secret alerts introduced by the PR are resolved. This directly reduces leaks at both the push and code-review stages with almost no extra setup.

GitGuardian (ggshield CLI + platform)

CLI tool that integrates into pre-commit, pre-push, and CI pipelines across GitHub Actions, GitLab, Jenkins, CircleCI, Azure Pipelines, and others. It can be set as a required check so PRs with detected secrets are blocked. The broader platform monitors repositories continuously, supports historical scans, and includes features like honeytokens. Focused on stopping credential exposure before it reaches shared code or runners.

detect-secrets

Open-source (originally from Yelp) that works well in pre-commit and CI. It supports baseline files so existing known secrets do not flood alerts, making it practical for mature codebases during code review and pipeline enforcement.

GitLab Secret Detection

Built into GitLab CI/CD (powered by Gitleaks under the hood). Runs as part of pipelines and can enforce merge-request blocking when secrets are found. Convenient for teams already on GitLab who want native protection in code review and CI without adding extra tools.

Recommended layered approach for reducing leaks

• Most teams combine tools: Gitleaks (or similar) as a local pre-commit/pre-push hook plus a required CI/PR check, GitHub or GitLab native push/PR protection for the platform layer, and occasional TruffleHog verified scans for history or deeper audits. This catches secrets at the developer machine, during code review, and in the pipeline before they can be merged or deployed. These tools emphasize prevention in the exact workflows you mentioned—code review and CI—rather than only post-leak discovery.