env-leak 0.1.0

Scan your codebase for leaked API keys and secrets before they reach production

env-leak

Scan your codebase for leaked API keys, tokens, and secrets before they reach production.

Install

pip install env-leak

Usage

# Scan current directory
env-leak .

# Scan a specific path, skip test fixtures
env-leak ./src --exclude tests --exclude fixtures

# Disable entropy detection (pattern-only)
env-leak . --no-entropy

# Output JSON for CI pipelines
env-leak . --json > report.json

What it detects

Type	Examples
OpenAI / Anthropic API keys	sk-..., sk-ant-...
AWS credentials	AKIA... access key IDs, secret key assignments
GitHub tokens	ghp_, gho_, github_pat_
Stripe keys	sk_live_, pk_live_
Google / Firebase	AIza..., Firebase server keys
Slack tokens	xoxb-, xoxp-
JWT tokens	Any eyJ...eyJ... pattern
Private keys	PEM headers in source files
Passwords in URLs	https://user:pass@host
Generic assignments	api_key = "...", secret = "..."
High-entropy strings	Statistically random strings ≥ 20 chars

CI integration

# .github/workflows/secret-scan.yml
- name: Scan for secrets
  run: pip install env-leak && env-leak . --no-entropy --json

Exit code 1 when secrets are found — makes it a natural CI gate.

How entropy detection works

env-leak computes Shannon entropy for tokens longer than 20 characters. Real API keys and tokens are nearly random (entropy ≥ 4.5 bits/char). Normal English words and code identifiers score ~3.5. This catches secrets that don't match any known pattern.

License

MIT