How we measure accuracy and noise
Other pages mention detection rates and false positives. This page explains where those numbers come from, what we tested, and what they do not promise.
Last updated: July 22, 2026
OpenSSL in our April 2026 benchmark (15 alerts vs 8,449)
From our internal tests, not a guarantee on every repo
These are our own test results
*From controlled tests and our published benchmark. Your repos may look different.
How to read these numbers
When you see “99.8%” or “2–5% false positives” on Puaro pages, they refer to specific tests, not a promise that every repository will match those figures.
| What you see | What it means | Where it comes from |
|---|---|---|
| 99.8% | On OpenSSL, Puaro raised 15 alerts while a popular regex scanner raised 8,449: about 99.8% fewer alerts in that one repo. | Benchmark report, April 2026 (8 open-source repos, ~2.2M lines) |
| 2–5% false positives | In our internal tests, most flagged items that were not real, actionable secrets fell in roughly this band. | Internal labeled tests during product development |
| Severity + explanation | Each finding gets a severity and a short reason in plain English, not a bare “possible secret” list. | Same benchmark and product behavior |
We share these so buyers know how we test. They are directional. They are not a warranty for every language, layout, or secret type.
What we look for
Three simple checks: did we catch a real problem, did we cry wolf, and can a developer act on it in a pull request?
True positive
A finding that matches a real or high-likelihood secret, confirmed by labeled data or review.
False positive
Something that looks like a secret but is not worth acting on: test fixtures, docs, placeholders, or random high-entropy strings.
Usable in a PR
A finding a developer can understand in a pull request without being a security specialist: severity, reason, and a next step.
How a scan works
We do not dump your whole repo into a chatbot and hope. We filter first, then score only the remaining suspects.
Drop obvious noise
Skip paths that are usually harmless: test folders, docs, examples, comments, and clear placeholders.
Find candidates
Match known credential shapes across many providers (2,000+ patterns).
Check the surrounding code
For each suspect: test value or real? Docs or live use? How serious? Output: severity, confidence, and a short explanation.
See where it goes
For stronger findings, follow how the value is used in code (for example a network call or a log) so the risk is clearer.
Where we can check with a provider that a credential is live, we use that to cut more noise. Timing is measured on cloud pull-request diffs, not a cold laptop CLI.
When we add languages or detectors, we re-run the core suites and update the date on this page. Full write-up: benchmark report.
What the benchmark showed
In April 2026 we scanned eight popular open-source repos (~2.2 million lines) with Gitleaks, TruffleHog, GitGuardian, and Puaro. Here are the highlights.
OpenSSL
Gitleaks raised 8,449 alerts. Puaro raised 15, five of them treated as real threats (2 critical, 3 high), each with a written reason.
Eight repos total
Across ~2.2 million lines, Gitleaks raised about 9,793 alerts. Puaro raised about 2,236, with severity on every finding.
OWASP WrongSecrets
Alert counts were similar across tools, but Puaro marked them low and explained they were training material, not live risk.
Details and tables: We tested 4 secret scanners on 8 real repos. Tool fit: Puaro vs Gitleaks vs TruffleHog.
What we do not claim
Clear limits so you can compare tools without inflated promises.
Try it on your own code
The best check is your repos. Connect GitHub or GitLab, open a few pull requests that include known test secrets, and compare noise to your current scanner. Design partners get help during that pilot.
See it on your next PR
Connect a repository in under 5 minutes.
No credit card. No servers to run.
Keep exploring detection
Comparisons, the full benchmark tables, and notes for AI agents.