Secret Scan

What it does

One Python file that finds API keys, tokens, private keys and passwords before they reach a commit, a pushed branch, a chat message or a published package. Standard library only, no network: your code and secrets never leave the machine.

secret_scan.py                    # working tree
secret_scan.py --staged           # before a commit
secret_scan.py --diff origin/main # a branch or PR
secret_scan.py --history          # every commit, every branch
secret_scan.py package.zip        # a package before publishing
secret_scan.py --stdin            # text before you paste it

Rules that fit real projects

• 39 provider-specific rules: Anthropic, OpenAI, AWS, GitHub, GitLab, Stripe, Slack, Google, Groq, Supabase, Databricks, Telegram, Discord, Twilio, SendGrid, npm, PyPI, Hugging Face, Shopify, DigitalOcean, Azure and more
• Tuned heuristics for passwords, connection strings, config values, bearer tokens and committed .env files
• Low noise: placeholders, ${VAR}, os.environ[...], lockfiles and fixtures handled. Zero failing findings on two real open-source repositories of about 3,000 files
• Output is always redacted, with where to rotate each key. JSON and SARIF for GitHub code scanning. Baseline for existing repos

Guard rails

• A git pre-commit hook that keeps your existing hook
• A Claude Code hook that blocks the agent from writing a key into a tracked file, or committing or pushing one (including git add -A && git commit, git -C, and first pushes), tells it to use an environment variable instead, and cannot be waved through by the agent itself

Includes a remediation playbook (rotate first, then fix, then decide about history) and CI recipes. 102 automated tests; the fake tokens in them are assembled at runtime, so the package itself scans clean.

Built by Nex AI, nex-ai.be