secretscan

Scan a directory for hardcoded secrets before they get committed. Reports the file, line, rule, and a masked preview of each match. Dependency-free, so it drops straight into CI or a pre-commit hook.

python secretscan.py .              # scan the current tree
python secretscan.py src/ --json    # machine-readable output
python secretscan.py . -x 'tests/*' -x '*.example'

Exit code is 1 when anything is found, 0 when clean.

secretscan .

  AWS access key id
    config.py:2  AKIA************MPLE
  GitHub token
    config.py:3  ghp_********************************abcd
  Private key block
    deploy/key.pem:1  ----***********************----

3 potential secret(s) found.

• Cloud and provider keys: AWS access key id, Google API key, Slack token, Stripe live key, Twilio key, GitHub token.
• Private key blocks (-----BEGIN ... PRIVATE KEY-----).
• JWTs.
• Generic assignments: api_key, secret, token, password set to a quoted literal of 12+ characters.

Matches are masked in output (AKIA************MPLE) so the tool never reprints a full secret. Binary files, large files (> 2 MB), and common vendored paths (node_modules/, .git/, build output) are skipped by default; add more with -x.

secretscan.py
  RULES       (name, compiled regex) pairs, precision-first
  walk        recurse, skip excluded/binary/large files
  scan_file   line-by-line regex search
  mask        keep first/last 4 chars, star the middle

These are pattern heuristics: they catch the common cases, not everything, and can occasionally false-positive on long random-looking strings. Treat findings as leads to review, not proof.

Python 3.9+. No third-party packages.

MIT