CredSweeper

GitHub release (latestSemVer) Documentation Status License PyPI Python Test codecov CII Best Practices OpenSSF Scorecard

Introduction

CredSweeper is an advanced credential detection tool designed to identify exposed credentials such as passwords, API keys, tokens, and other sensitive information across source code, configuration files, documents, and binary assets. CredSweeper scans regular files, embedded data in containers, and files added in Git commits. The tool combines pattern-based detection, machine learning–based validation, and deep file inspection to deliver comprehensive and accurate security scanning for modern codebases and repositories.

Key Capabilities:

  • Credential detection in source code, configuration files, documents, and archives
  • False positive reduction using algorithmic filters and machine learning
  • Scanning of compressed files, documents, and binary formats
  • Git repository analysis and diff scanning

Full documentation can be found here: https://credsweeper.readthedocs.io/

How To Use

Main Requirements

  • Python 3.10, 3.11, 3.12, 3.13, 3.14

Installation

Details here.

pip install credsweeper

Run

How to use.

Run CredSweeper:

python -m credsweeper --path tests/samples/password.gradle --save-json output.json

JSON Output

[
    {
        "rule": "Password",
        "severity": "high",
        "confidence": "moderate",
        "ml_probability": 0.993,
        "line_data_list": [
            {
                "line": "password = \"cackle!\"",
                "line_num": 1,
                "path": "./tests/samples/password.gradle",
                "info": "",
                "variable": "password",
                "variable_start": 0,
                "variable_end": 8,
                "value": "cackle!",
                "value_start": 12,
                "value_end": 19,
                "entropy": 2.52164
            }
        ]
    }
]

Config

credsweeper/secret/config.json - Configuration file for pre-processing of CredSweeper. For more details please check here.

You can set the pattern, extension and path you want to exclude from scanning as below.

{
    "exclude": {
        "pattern": [
            "AKIA[0-9A-Z]{9}EXAMPLE",
            ...
        ],
        "extension": [
            "gif",
            "jpg",
            ...
        ],
        "path": [
            "/.git/",
            "/openssl/",
            ...
        ]
    },
    ...
}

And you can also set source_ext, source_quote_ext, find_by_ext_list, check_for_literals, line_data_output, and candidate_output as below.

  • source_ext: List of extensions for scanning categorized as source files.
  • source_quote_ext: List of extensions for scanning categorized as source files that use quotes.
  • find_by_ext_list: List of extensions to detect only extensions.
  • check_for_literals: Bool value for whether to check line has string literal declaration or not.
  • line_data_output: List of attributes of line_data for output.
  • candidate_output: List of attributes of candidate for output.
{
    ...
    "source_ext": [
        ".py",
        ".cpp",
        ...
    ],
    "source_quote_ext": [
        ".py",
        ".cpp",
        ...
    ],
    "find_by_ext_list": [
        ".pem",
        ".cer",
        ...
    ],
    "check_for_literals": true,
    "line_data_output": [
        "line",
        "line_num",
        ...
    ],
    "candidate_output": [
        "rule",
        "severity",
        ...
    ]
}

credsweeper/rules/config.yaml - Configuration file for setting Rule. For more details please check here.

- name: Credential
  severity: medium
  confidence: moderate
  type: keyword
  values:
    - credential
  filter_type: GeneralKeyword
  use_ml: true
  min_line_len: 18
  required_substrings:
    - credential
  target:
    - code

Develop

Tests

Run all tests with random order:

python -m pytest --cov=credsweeper --cov-report=term-missing --random-order --random-order-bucket=global -s tests/

Benchmark

We have a dataset for testing credential scanners called CredData. If you want to test CredSweeper with this dataset please check here.

Overall Architecture

To check overall architecture of CredSweeper please check here.

Retrain Model

If you want to check how model was trained or retrain it on your own data, please refer to the experiment folder

License

The CredSweeper is an Open Source project released under the terms of MIT License.

How to Get Involved

In addition to developing under an Open Source license, the project follows an Open Source Development approach, welcoming everyone to participate, contribute, and engage with each other through the project.

Project Roles

The project recognizes the following formal roles: Contributor and Maintainer. Informally, the community may organize itself and grant additional rights and responsibilities to the necessary people to achieve its goals.

Contributor

A Contributor is anyone who wishes to contribute to the project, at any level. Contributors are granted the following rights to:

  • Contribute code, documentation, translations, artwork, samples, etc.
  • Report defects (bugs) and suggestions for enhancement.
  • Participate in the process of reviewing contributions by others.

If you want to participate in the project development, check out the how to contribute guideline in advance.

Contributors who show dedication and skill are rewarded with additional rights and responsibilities. Their opinions weigh more when decisions are made, in a fully meritocratic fashion.

Maintainer

A Maintainer is a Contributor who is also responsible for knowing, directing and anticipating the needs of a given Module. As such, Maintainers have the right to set the overall organization of the source code in the Module, and the right to participate in the decision-making. Maintainers are required to review the contributor’s requests and decide whether to accept or not.

Name E-Mail
Jaeku Yun jk0113.yun@samsung.com
Shinhyung Choi sh519.choi@samsung.com
Roman Babenko r.babenko@samsung.com
Yuliia Tatarinova yuliia.t@samsung.com

How to Contact

Please post questions, issues, or suggestions in issues. This is the best way to communicate with the developers.

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

4 maintainers

PyPI data
Data sourced directly from PyPI's database.
Avatar for alexrin from gravatar.com alexrin Avatar for csh519 from gravatar.com csh519 Avatar for Dmytro-NK from gravatar.com Dmytro-NK
+1 more Avatar for silentearth from gravatar.com silentearth

License

MIT License (MIT)

Requires

Python >=3.10

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

credsweeper-1.18.1.tar.gz (10.7 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

credsweeper-1.18.1-py3-none-any.whl (10.8 MB view details)

Uploaded Python 3

File details

Details for the file credsweeper-1.18.1.tar.gz.

File metadata

  • Download URL: credsweeper-1.18.1.tar.gz
  • Upload date:
  • Size: 10.7 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for credsweeper-1.18.1.tar.gz
Algorithm Hash digest
SHA256 ca36b59c114d5526f9271ef5d6789ba09627171375da6911415883cc7373d5d3
MD5 6503837d4212197ae65fc060e8b3f4ef
BLAKE2b-256 2a1ebaee971181000b8024e27e64f31084090e8c49a245385e0547ea9aaba41a

See more details on using hashes here.

File details

Details for the file credsweeper-1.18.1-py3-none-any.whl.

File metadata

  • Download URL: credsweeper-1.18.1-py3-none-any.whl
  • Upload date:
  • Size: 10.8 MB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for credsweeper-1.18.1-py3-none-any.whl
Algorithm Hash digest
SHA256 debe16b5c84c17fa4fb55aaa5d91a8d4d2a6bc27c861922eb54d360e2e0bb0e5
MD5 01a363e6e3da581b638ceb9477aca160
BLAKE2b-256 5b8fb1babbce705010f239c003a89e1aa04c219f31915ce94b89336c835efd45

See more details on using hashes here.

Release history Release notifications | RSS feed

This release

1.18.1 This release

2 files

1.18.0

2 files

1.17.4

2 files

1.17.3

2 files

1.17.2

2 files

1.17.1

2 files

1.17.0

2 files

1.16.2

2 files

1.16.1

2 files

1.16.0

2 files

1.15.8

2 files

1.15.7

2 files

1.15.6

2 files

1.15.5

2 files

1.15.4

2 files

1.15.3

2 files

1.15.2

2 files

1.15.1

2 files

1.15.0

2 files

1.14.8

2 files

1.14.7

2 files

1.14.6

2 files

1.14.5

2 files

1.14.4

2 files

1.14.3

2 files

1.14.2

2 files

1.14.1

2 files

1.14.0

2 files

1.13.4

2 files

1.13.3

2 files

1.13.2

2 files

1.13.1

2 files

1.13.0

2 files

1.12.2

2 files

1.12.1

2 files

1.12.0

2 files

1.11.6

2 files

1.11.5

2 files

1.11.4

2 files

1.11.3

2 files

1.11.2

2 files

1.11.1

2 files

1.11.0

2 files

1.10.8

2 files

1.10.7

2 files

1.10.6

2 files

1.10.5

2 files

1.10.4

2 files

1.10.3

2 files

1.10.2

2 files

1.10.1

2 files

1.10.0

2 files

1.9.6

2 files

1.9.5

2 files

1.9.4

2 files

1.9.3

2 files

1.9.2

2 files

1.9.1

2 files

1.9.0

2 files

1.8.4

2 files

1.8.3

2 files

1.8.2

2 files

1.8.1

2 files

1.8.0

2 files

1.7.1

2 files

1.7.0

2 files

1.6.4

2 files

1.6.3

2 files

1.6.2

2 files

1.6.1

2 files

1.6.0

2 files

1.5.12

2 files

1.5.11

2 files

1.5.10

2 files

1.5.9

2 files

1.5.7

2 files

1.5.6

2 files

1.5.5

2 files

1.5.4

2 files

1.5.3

2 files

1.5.2

2 files

1.5.1

2 files

1.5.0

2 files

1.4.12

2 files

1.4.11

2 files

1.4.10

2 files

1.4.9

2 files

1.4.8

2 files

1.4.7

2 files

1.4.6

2 files

1.4.5

2 files

1.4.4

2 files

1.4.3

2 files

1.4.2

2 files

1.4.1

2 files

1.4.0

2 files

1.3.1

2 files

1.3.0

2 files

1.2.1

2 files

1.2.0

2 files

1.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page