secret-scan

Scans files and git history for accidentally committed secrets. Zero dependencies — runs with npx secret-scan.

Detects API keys, tokens, passwords, private keys, and database credentials across 20+ patterns.

---

Why?

gitleaks and truffleHog are the gold standard but require Go/Python installation. secret-scan is a single Node.js file. If you have Node.js, you can run it right now.

---

Install

npm install -g secret-scan

Or without installing:

npx secret-scan

---

Usage

# Scan current directory
secret-scan

# Scan a specific project
secret-scan ./backend

# Also scan the last 100 commits in git history
secret-scan --git

# CI mode — exit 1 on any finding
secret-scan --strict

# JSON output
secret-scan --json

---

Example Output

secret-scan  my-app
  Scanned 87 files

  ✘ 3 potential secret(s) found:

  HIGH:
    Stripe Secret Key            src/payments.js:12
      sk_live_…****************************

    Database URL (with password) config/database.js:5
      postgres://user:****@localhost/mydb

  MEDIUM:
    JWT Token                    test/fixtures/auth.js:8
      eyJh…****

  Snippets are redacted. Review the flagged files manually.

---

What It Detects

Secret Type	Severity
Private keys (RSA, EC, OpenSSH)	HIGH
AWS Access Key / Secret Key	HIGH
Stripe secret key (sk_live_, sk_test_)	HIGH
Google API key (AIza…)	HIGH
GitHub tokens (ghp_, gho_, ghs_)	HIGH
Slack tokens (xox*)	HIGH
SendGrid API key	HIGH
NPM publish token	HIGH
Telegram bot token	HIGH
Database URLs with passwords	HIGH
Heroku API key	HIGH
Square access token	HIGH
Stripe publishable key	MEDIUM
Slack webhook URL	MEDIUM
JWT token	MEDIUM
Twilio account SID	MEDIUM
Hardcoded passwords in code	MEDIUM
Hardcoded API keys in code	MEDIUM

---

CI Integration

# .github/workflows/security.yml
name: Secret Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 50   # for --git history scan
      - run: npx secret-scan --git --strict

---

Git History Scan

With --git, secret-scan scans the added lines in the last 100 commits. This catches secrets that were added and later removed — they're still in the history.

secret-scan --git

# Findings like:
  AWS Access Key   git:a3f7c2d:23
    AKIA…****

Use git show a3f7c2d to inspect the full commit, then consider removing the secret from history.

---

False Positives

Some patterns (JWT, hardcoded passwords) may flag test fixtures or example values. Review flagged lines manually. The --strict flag is not recommended if you have many test fixtures.

---

License

MIT

---

Keywords

secret scanner · credential leak · api key detection · gitleaks alternative · trufflehog alternative · detect secrets · password scan · aws key · zero dependencies · security

---

Built to solve, shared to help — Rushabh Shah 🛠️✨

_{One of 40+ zero-dependency developer CLI tools — no node_modules, ever.}