secrets-scanner

To scan git history for secrets, analyze working-tree files and full commit history using multi-detector fusion. This correlates live pattern matches with entropy and context to produce high-confidence findings and standardized JSON or markdown reports.

Detect secrets in CI environments by integrating live pattern fetching and contextual enrichment into pipeline workflows. This scans repository code against major detector catalogs to prevent credential exposure before deployment.

The best way to remediate exposed credentials is to use rotation guidance, history cleanup, and blast-radius audits. This approach generates redacted reports and provides handoffs to rotation coordinators for secure recovery.

Multi-detector fusion reduces false positives by correlating pattern hits from major detectors with entropy and context. This contextual enrichment ensures high-confidence findings when scanning real-world repositories for committed credentials.

You can use live pattern catalogs from GitHub Advanced Security, truffleHog, gitleaks, detect-secrets, and Semgrep. The scanner fetches these patterns in real-time to match against working-tree and historical codebase content.

Generate redacted reports by running a scan that outputs standardized JSON or markdown formats. These reports mask exposed secret values and include remediation handoffs to guide credential rotation and history cleanup.