What problem does it solve? It prevents accidental commits of secrets such as API tokens, private keys, and hardcoded passwords by scanning files before they enter a git repository, and it can redact leaked credentials in place. ## Core Features & Use Cases - Multi-mode scanning: Scan staged changes, all tracked files, a directory tree, or a single file, with exit codes 0 (CLEAN), 1 (BLOCK), and 2 (WARN) for gating commits. - Pattern-based detection: Regex rules catch GitHub/GitLab/AWS/npm tokens, PEM private keys, long hex credentials, hardcoded passwords, and warn on private IPs or Bearer tokens, with placeholder and lab-IP suppression to reduce false positives. - Sanitize mode: Redact BLOCK-level findings in place while preserving JSON keys and quoting structure, then re-scan to confirm the file is clean. - Use Case: Before committing a config backup, run the sanitize mode to strip embedded credentials, then commit the sanitized file safely. ## Quick Start Ask Claude to run the security scan on your staged git changes and report any leaked credentials before committing.
