cfsniff

A good dog that sniffs out leaked secrets in files, directories, and text — powered by the ClassiFinder API.

Install

pipx install cfsniff

Or with pip:

pip install cfsniff

Quick Start

# 1. Install
pipx install cfsniff

# 2. Set your API key (get one at https://classifinder.ai)
export CLASSIFINDER_API_KEY=cf_live_...

# 3. Sniff something
cfsniff audit

Usage

Scan a file

cfsniff secrets.txt

Scan a directory

cfsniff ./src

Pipe text in

echo "token=ghp_abc123..." | cfsniff

Scan your clipboard

cfsniff --clipboard

Audit current directory

cfsniff audit

Audit with extra paths

cfsniff audit --include logs

Audit and open an HTML report

cfsniff audit --report report.html --open

Output Formats

cfsniff audit                    # rich (default, color terminal output)
cfsniff audit --format plain     # plain text (CI-friendly)
cfsniff audit --format json      # machine-readable JSON

HTML Reports

The --report flag writes a self-contained HTML file with a full findings summary — useful for sharing with teammates or attaching to tickets.

cfsniff audit --report report.html --open

API Key

Get a free API key at https://classifinder.ai.

Set it via environment variable:

export CLASSIFINDER_API_KEY=cf_live_...

Verifying This Build

Every release is published via PyPI Trusted Publishing with PEP 740 build attestations. No long-lived API tokens. The wheel you pip install is byte-identical to what GitHub Actions built from a tagged commit.

To verify a release: visit the project page on PyPI, click Download files, and check the Provenance section under each artifact. You'll see the sigstore attestation, the GitHub workflow run, and the exact commit SHA — all logged to the public Sigstore transparency log for independent verification.

This answers "is the wheel what's in the source?" — the cryptographic chain proves this wheel was built from ClassiFinder/cfsniff at the tagged commit, by a GitHub-hosted runner, and cannot be tampered with after the fact.

License

MIT