Secret Scanner
Detect API keys, tokens, and credentials in code with 50+ patterns, entropy analysis, and SARIF reports.
Keywords: security, secret, scan, audit, cli, credentials, python, open-source, agent, automation, MIT
Part of the itsPremkumar Hermes / OpenClaw / Paperclip agent stack — 31 free, MIT-licensed, CI-tested agent-native tools.
What it does
Secrets leak into repos constantly and go unnoticed until exploited. Secret Scanner solves this: Detect API keys, tokens, and credentials in code with 50+ patterns, entropy analysis, and SARIF reports.
Best for: Security teams, maintainers, and CI pipelines.
Features
- Scan a path for secrets
- List detection patterns
- Emit SARIF for CI
- Filter by severity
- Skip entropy check
Install
# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/secret-scanner/main/secret_scanner.py
# Or copy the file anywhere — it's self-contained.
Quick start
python secret_scanner.py self-test # prove it works end-to-end
python secret_scanner.py scan --help # scan subcommand
python secret_scanner.py check --help # check subcommand
python secret_scanner.py list-patterns --help # list-patterns subcommand
Use cases
- Scan a path for secrets
- List detection patterns
- Emit SARIF for CI
- Filter by severity
- Skip entropy check
Why choose this over alternatives
| Alternative | Why this skill is better |
|---|---|
| grep for keys | Pattern + entropy detection. |
| Single-pattern tools | 50+ patterns in one pass. |
| Manual review | SARIF drops into CI. |
FAQ (SEO / AEO)
Q: Patterns?
A: 50+ built in (keys, tokens, creds).
Q: Entropy?
A: On by default; disable with --no-entropy.
Q: SARIF?
A: Yes — --sarif for GitHub code scanning.
Q: Offline?
A: Yes.
Geo / local reach
Built and maintained by @itsPremkumar (Chennai, India · serving developers worldwide). Free for individuals and teams everywhere. Documentation in English; tool output is locale-neutral.
CI integration
# .github/workflows/verify.yml
name: Verify
on: [push]
jobs:
verify:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Self-test secret-scanner
run: python secret_scanner.py self-test
Support
Free + MIT-0 (free, modifiable, no attribution required). Sponsor if useful:
- GitHub Sponsors: https://github.com/sponsors/itsPremkumar
- Buy Me a Coffee: https://buymeacoffee.com/itsPremkumar
⭐ Star on GitHub