secretscan 🔍 v0.2.1

⭐ If secret-scan saves your repo from a leaked key, a star helps others find it.

A fast secret scanner for your codebase. secretscan helps you find and remediate exposed credentials, API keys, and sensitive information before they become security vulnerabilities.

🎬 Demo

Recorded from the actual binary with asciinema + agg — all secrets shown are documentation examples.

✨ Features

• 🚀 Parallel Scanning: Multi-threaded scanning with Rayon
• 🎯 Pattern + Entropy Detection: Regex-based pattern matching plus entropy analysis (30+ secret types)
• 📦 Zero Config: Works out of the box with sensible defaults
• 🔧 Customizable: Add your own patterns and configure detection rules
• 🌈 Beautiful Output: Colored terminal output with progress indicators
• 📊 Multiple Formats: JSON and text output formats
• 🚫 GitIgnore Support: Respects .gitignore patterns automatically
• 🔍 Advanced Detection: Supports obfuscated secrets (Base64, Hex, Character Arrays)

🛠️ Installation

From Crates.io

cargo install secretscan

From Source

git clone https://github.com/adventurewave-labs/secret-scan.git
cd secret-scan
cargo install --path .

Requirements

• Rust 1.70.0 or higher
• Git (for respecting .gitignore files)

🚀 Quick Start

Scan the current directory:

secretscan

Scan a specific directory:

secretscan /path/to/project

Output results as JSON:

secretscan --format json

Save results to a file:

secretscan --output results.txt

📖 Usage

secretscan [OPTIONS] [PATH]

Arguments:
  [PATH]  Path to scan for secrets [default: .]

Options:
  -f, --format <FORMAT>  Output format [default: text] [possible values: json, text]
  -o, --output <FILE>    Output file (default: stdout)
  -q, --quiet            Suppress progress bar
      --skip-tests       Skip test files and test-related patterns to reduce false positives
  -h, --help             Print help
  -V, --version          Print version

Example Output

$ secretscan test-repo/

Warning: Found 34 potential secrets:

File: test-repo/test/test_secrets.py
line 6: AWS_KEY = "AKIAIOSFODNN7TESTKEY"
Pattern: AWS Access Key
Match: AKIAIOSFODNN7TESTKEY
Entropy: 3.5

File: test-repo/config/production.yml
line 9: access_key_id: AKIAIOSFODNN7PRODKEY
Pattern: AWS Access Key
Match: AKIAIOSFODNN7PRODKEY
Entropy: 3.6

File: test-repo/src/config.js
line 8: GITHUB_TOKEN: "ghp_1234567890abcdefghijklmnopqrstuvwxyz",
Pattern: GitHub Token
Match: ghp_1234567890abcdefghijklmnopqrstuvwxyz
Entropy: 5.2

File: test-repo/src/config.js
line 11: GOOGLE_API_KEY: "AIzaSyDdI0hCZtE6vySjMm-WEfRq3CPzqKqqsHI",
Pattern: Google API Key
Match: AIzaSyDdI0hCZtE6vySjMm-WEfRq3CPzqKqqsHI
Entropy: 4.7

34 secrets found:
AWS Access Key: 4
Google API Key: 4
GitHub Token: 3
PostgreSQL URL: 1
(and 22 more...)

real    0m0.005s
user    0m0.001s
sys     0m0.003s

🎯 Detected Secret Types

SecretScanner can detect various types of secrets including:

• Cloud Provider Keys

  • AWS Access Keys and Secret Keys
  • Google Cloud API Keys
  • Azure Subscription Keys

• Version Control Tokens

  • GitHub Personal Access Tokens
  • GitLab Personal Access Tokens
  • Bitbucket App Passwords

• API Keys

  • Slack Tokens
  • Stripe API Keys
  • SendGrid API Keys
  • Twilio API Keys
  • Mailgun API Keys

• Cryptographic Materials

  • Private Keys (RSA, DSA, EC)
  • PEM Certificates

• Authentication Credentials

  • JWT Tokens
  • Basic Auth Credentials
  • Database Connection Strings
  • OAuth Tokens

🔍 How It Works

secretscan uses advanced regex-based pattern matching to detect secrets:

Detection Process

1. Pattern Matching: Uses curated regex patterns to identify potential secrets
2. Entropy Analysis: Calculates randomness to detect high-entropy strings
3. Contextual Filtering: Reduces false positives by analyzing surrounding code
4. Parallel Processing: Leverages all CPU cores for maximum throughput

🔧 Configuration

SecretScanner automatically respects .gitignore patterns for file exclusion. The scanner comes with 50 built-in patterns covering all major secret types.

📊 Performance

secretscan is written in Rust and uses rayon to scan files in parallel across CPU cores, with no runtime dependencies (JVM, interpreter, etc.) to start up.

No throughput, latency, or memory numbers are published here. An earlier version of this README cited specific figures (files/sec, MB/sec, memory-per-file) attributed to a SECRET_SCAN_VALIDATION_REPORT.md that isn't part of this repository, plus a few spots where a fabricated number had been stripped and replaced with the literal placeholder text "fast scanning" rather than a real one. Both are removed rather than replaced with new unverified numbers — they'll come back if a real, reproducible benchmark gets committed alongside the report that backs it.

🎯 Accuracy

No recall, precision, or F1 numbers are published here. An earlier version of this README cited specific figures (95.2% recall, 98.2% precision, 96.7% F1, 2.1% false-positive rate) attributed to the same nonexistent SECRET_SCAN_VALIDATION_REPORT.md. They've been removed rather than re-derived from nothing. What's true of the detection approach itself:

• Obfuscation detection: Base64, Hex, URL encoding, character arrays
• Smart filtering: Production vs test environment awareness

Detection Capabilities

• ✅ Production secrets: Config files, environment variables, connection strings
• ✅ Obfuscated secrets: Base64/Hex encoded, URL encoded database URLs
• ✅ Cloud providers: AWS, Azure, GCP credentials and session tokens
• ✅ Payment APIs: Stripe, PayPal, Square with all key variants
• ✅ Communication: SendGrid, Slack, Twilio, Discord tokens
• ✅ Multiple formats: 50+ file types including .txt, config files
• ✅ Advanced patterns: 50 comprehensive secret patterns
• ❌ Intelligently filtered: Test fixtures, examples, dummy data

Obfuscation Detection

secretscan detects secrets hidden behind common encodings:

• Base64 encoded API keys: api_key_b64 = "QUtJQUlPU0ZPRE5ON1RFU1RLRVk="
• Hex encoded secrets: secret_hex = "736b2d7465737431323334"
• Character arrays: [115, 107, 45, 116, 101, 115, 116] → "sk-test"
• URL encoded DB URLs: postgres%3A%2F%2Fuser%3Apass%40host

🔧 Comparison with Other Tools

Capability comparison against other secret-scanning tools. Performance figures (speed, binary size, memory usage) aren't included below — secretscan doesn't have published, reproducible numbers to compare fairly (see Performance above), so a table mixing real competitor numbers against unbacked ones would be misleading either way.

Feature	secretscan	truffleHog	git-secrets	detect-secrets
Language	Rust	Python	Bash	Python
GitIgnore Support	✅ Built-in	✅ Yes	❌ No	✅ Yes
Entropy Analysis	✅ Yes	✅ Yes	❌ No	✅ Yes
Parallel Processing	✅ Native	❌ No	❌ No	❌ No
JSON Output	✅ Yes	✅ Yes	❌ No	✅ Yes
Test File Filtering	✅ Yes	❌ No	❌ No	✅ Yes
Obfuscation Detection	✅ Advanced	❌ No	❌ No	❌ No
Installation	Single binary (cargo install)	pip + deps	git + bash	pip + deps

Ecosystem

Repo	What it does
codescope	Rust code-intelligence engine for AI agents — no cloud, no DB
Sentinel	Deny-by-default agentic sysadmin: Investigate → Plan → Approve → Act
netrain	Matrix-style network monitor in Rust
turbo-flow	Agentic dev environment — 60+ AI subagents, SPARC methodology

🤝 Contributing

We welcome contributions! Please see our Contributing Guidelines for details.

Development

# Clone the repository
git clone https://github.com/adventurewave-labs/secret-scan.git
cd secret-scan

# Run tests
cargo test

# Run with debug output
RUST_LOG=debug cargo run -- .

# Check code coverage
cargo tarpaulin

# Run benchmarks
cargo bench

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• Built with Rust 🦀
• Pattern matching powered by regex
• Parallel processing with rayon
• Git integration via ignore

📞 Support

• 🐛 Issues: GitHub Issues

---

Made with ❤️ by the secretscan Team