check-security

To scan a repository for committed secrets, you can use this tool to automatically check your codebase for sensitive information like API keys or passwords and prevent accidental exposure.

A secrets baseline is a `.secrets.baseline` file used to track previously found secrets. It works by recording known secrets so that subsequent repository scans only flag newly introduced sensitive information.

Yes, you can scan a specific directory path instead of the whole repository. The tool supports scope selection, allowing you to target either the entire codebase or a specific path for secret detection.

You do not need to manually install detect-secrets before scanning. The tool verifies if the detect-secrets CLI is installed during execution and automatically attempts to install it if it is missing.

The best way to prevent API keys from leaking is to perform regular secret detection scans. This identifies accidentally committed sensitive information across your entire repository so you can remove it before exposure.