Secret Detector

Secret Detector scans your codebase for exposed credentials and sensitive secrets. It uses pattern matching and entropy analysis to find API keys, database passwords, private keys, OAuth tokens, and other credentials that should never be committed to version control.

How It Works

1. Pattern scanning — Matches against 200+ known secret patterns (AWS keys, GitHub tokens, Stripe keys, JWT secrets, etc.)
2. Entropy analysis — Detects high-entropy strings that may be randomly generated secrets
3. Git history scan — Examines all commits, including deleted files and force-pushed history
4. Context analysis — Distinguishes real secrets from test fixtures, examples, and documentation
5. Remediation advice — Provides steps to rotate compromised secrets and prevent future leaks

Best For

• Pre-commit hooks to prevent secret leaks before they happen
• Auditing repositories after team member offboarding
• Compliance checks for SOC 2 and PCI DSS requirements
• Reviewing open-source contributions for accidental secret exposure

Detection Coverage

Covers AWS, GCP, Azure, GitHub, GitLab, Slack, Stripe, Twilio, SendGrid, database connection strings, private keys (RSA, SSH, PGP), and JWT signing secrets.