oss-secret-scan

To scan a repository for leaked secrets and PII, this tool uses a deterministic detector combining regex patterns and Shannon entropy to identify leak candidates, outputting findings via standard output with optional JSON mode and severity filtering.

Entropy analysis for secret detection calculates Shannon entropy to identify high-randomness strings that likely represent leaked secrets, combining these results with regex pattern matching to reduce false positives without relying on model inference.

Yes, you can use this deterministic scanner as a pre-release gate in CI to ensure code released publicly is free of secrets, utilizing allowlists and severity filtering to triage leak candidates across large mono-repos and multi-language projects.

The best way to triage leaked infrastructure data is to use a deterministic scanner to surface candidates for human review, keeping triage decisions separate from detection to ensure safe remediation without false positives from LLM inference.

Yes, this secret scanner supports JSON output mode for CI workflows, allowing you to filter findings by severity and parse standard output programmatically alongside regex and entropy analysis across multi-language projects.

Using an allowlist instead of model inference for finding leaked PII ensures deterministic detection with low false positives, preventing the model from hallucinating sensitive data and keeping human triage decisions strictly separate from the detection logic.