secret-scanner

Secret-scanner detects and blocks commits containing exposed API keys, database credentials, and tokens before they reach your repository. It integrates with Git pre-commit hooks to catch hardcoded secrets like AWS keys, Stripe tokens, and JWTs in real time, alerting you to move sensitive data to environment variables.

Secret detection tools identify patterns matching AWS access keys, private keys, database credentials, API tokens, JWTs, and other common secret formats across source files and configuration files. Detection applies automatically during file saves and before commits to cover development workflows.

Yes, secret-scanner integrates directly into Git as a pre-commit hook, blocking commits containing secrets without disrupting your development process. It works across repositories and applies automatically when you save files or attempt to commit.

When secret-scanner flags exposed credentials, it suggests moving them to environment variables and adding sensitive files like `.env` to `.gitignore`. This prevents re-exposure and follows secret-management best practices.

Secret-scanner uses pattern-based detection to identify common secret formats including API keys, private keys, tokens, and passwords. While it covers standard patterns, some custom or obfuscated credentials may require additional review or custom pattern rules.