secret-guard

May 16, 2026 · View on GitHub

hero

secret-guard

Block leaked API keys before they hit origin. Pattern + entropy. Redacted output.

License: MIT Python 3.8+ Claude Code Plugin Tests: 10 passing

TL;DR: /secret-guard → scans your staged diff for AWS / GitHub / Slack / Stripe / Google API keys, JWTs, private keys, and high-entropy base64 strings. Blocks the commit before the secret leaves your machine.

Writing

LinkedIn

Dev.to

Writing

Install (Claude Code + pre-commit)

git clone https://github.com/mturac/pluginpool-secret-guard ~/.claude/plugins/secret-guard

To wire as a pre-commit hook:

cp ~/.claude/plugins/secret-guard/hooks/pre-commit .git/hooks/pre-commit
chmod +x .git/hooks/pre-commit

Writing

Quick start

/secret-guard                                            # scan staged diff
python3 scripts/guard.py                                 # same, directly
python3 scripts/guard.py --files src/config.py .env      # scan specific files
python3 scripts/guard.py --allowlist .secretignore       # suppress known false positives

Writing

Flags

FlagDefaultDescription
--files F…staged diffScan specific files instead of the staged diff
--allowlist PATHnoneRegexes (one per line) that suppress matching findings
--formatjsonjson or md

Writing

Detected patterns

RuleMatch
AWS Access Key IDAKIA[0-9A-Z]{16}
GitHub PATgh[pousr]_[A-Za-z0-9]{36,}
Slack tokenxox[abpr]-[A-Za-z0-9-]{10,}
Stripe key`sk_(live
Google API keyAIza[0-9A-Za-z_-]{35}
JWTeyJ…\.eyJ…\.…
Private key-----BEGIN … PRIVATE KEY-----
Generic high-entropybase64-ish ≥32 chars, Shannon entropy ≥ 4.5

Writing

Example output (markdown)

# secret-guard report

| file | line | rule | snippet |
|---|---|---|---|
| src/config.py | 12 | aws-access-key | AKIA… |
| .env | 4 | stripe-key | sk_l… |

Note: snippets are always rule + first 4 chars + … — never the full secret.

Writing

Exit codes

CodeMeaning
0Clean — no secrets found
1At least one finding (commit is blocked when used as a hook)

Writing

Safety guarantees

  • test_redaction_contains_only_rule_and_first_four asserts the raw secret never appears in JSON or markdown output.
  • test_files_mode_does_not_crash_on_non_utf8 ensures non-UTF-8 / binary files are skipped, not crashed on.

Writing

Limitations

  • Pattern lists drift; submit PRs for new providers.
  • Entropy heuristic produces some false positives on minified bundles — use --allowlist to suppress.
  • Doesn't scan repo history; pair with git-secrets or trufflehog for that.

Writing

Examples

Step-by-step walkthroughs with real input fixtures and the helper's actual output live in examples/. Three or four scenarios per plugin — from the happy path to the edge cases the test suite guards.

Writing

Part of the pluginpool family

Ten focused Claude Code plugins for everyday productivity: commit-narrator · pr-storyteller · test-gap · deps-doctor · env-lint · secret-guard · standup-gen · todo-harvest · flaky-detector · changelog-forge

Writing

License

MIT — see LICENSE. Contributions welcome.