If an infostealer ran on your machine right now, what would it take?

Haul finds every API key, token, SSH key and password lying where stealer malware looks first,
scores how exposed each one is, and tells you exactly how to fix it.
It never reads a secret out. Read-only, offline, zero dependencies.

pip install haul-scanner

Why · Features · Screenshots · Quick start · Coverage · How it works · Safety · CI · FAQ

Defensive use only. Haul is a read-only self-audit tool. Run it on systems you own or are explicitly authorized to test. It scans the current user's own account, refuses other users' profiles and network paths, and makes zero network connections.

Why Haul

Infostealers don't need an exploit. They run once as you, then sweep everything you can already read:

• cloud and package-registry credentials: ~/.aws, gcloud, az, kubeconfig, .npmrc, .pypirc
• SSH keys with no passphrase, .env files in every project folder, shell and PowerShell history
• and, increasingly, the chat history of AI coding tools, where keys get pasted and .env files get echoed back

Most secret scanners look at repositories. Haul looks at your machine: the home folder, project folders, app-data stores and AI-tool transcripts that never reach a repo but sit on disk, readable by anything you run. It reports, ranks and explains. It never takes.

What you get

Nine scanners, one pass Cloud & package CLIs, SSH keys, .env files, shell & PowerShell history, environment variables, 12 AI coding tools, browsers, desktop apps and sensitive files.	AI-history aware Claude Code, Cursor, Copilot, Windsurf, Codex, Gemini CLI and more. Streams transcripts of any size and reads SQLite chat stores read-only. A key echoed 500× is one finding.
Git aware Knows whether a .env is ignored, not ignored, or already committed, by reading .git directly. Git is never executed.	Real risk, not noise 58 provider rules plus assignment, YAML, JSON and XML heuristics. Aggressive false-positive filtering, and a 0–100 exposure score for every finding.
Never discloses a value Secrets are sealed in memory the moment they are found. Reports carry only a non-reversible fingerprint, and an output firewall double-checks every byte.	Zero network, zero dependencies An irreversible audit hook blocks sockets, DNS and subprocesses for the whole run. Pure standard library, so there is no supply chain to attack.
Reports people actually read A worst-first terminal view with clickable paths, a self-contained HTML report, plus JSON, CSV and SARIF 2.1.0.	Built for CI Exit codes by severity, --fail-on, baselines that survive edits, and SARIF that maps straight onto your repository's files.

See it in action

Run haul and it walks your machine once. The live progress bar keeps moving even through hundreds of megabytes of AI transcripts.

The report is worst first. Every finding names its kind (API KEY, TOKEN, PRIVATE KEY, PASSWORD…), what it is and where it lives. Paths are clickable in modern terminals, and each fix appears once, numbered, under What to do.

Need to hand it to someone? haul -f html -o report.html writes one self-contained file with live search, severity filters and the same fixes. It needs no internet and loads nothing external.

_{Every screenshot is real Haul output, captured on a demo profile seeded with fabricated secrets.}

Quick start

Install it once, then run it as any normal user. Haul needs Python 3.11+ and nothing else.

pip install haul-scanner

pipx install haul-scanner

uv tool install haul-scanner

What it scans

Haul walks your working folders once into a shared inventory. It skips node_modules and build output, never follows symlinks or junctions, never touches network drives, and skips cloud-only OneDrive files, so a scan can never trigger a download.

How it works

• Specific beats generic. Provider rules run first and claim their match, so an Anthropic key is reported once as Anthropic, never again as "OpenAI-shaped". Literal prefilters skip rules that can't match a line, which keeps multi-hundred-megabyte transcripts fast.
• Two detection profiles. Config files also report plaintext passwords under strong keys (DB_PASSWORD=…). History (transcripts, shell history, logs) reports only tokens and high-entropy values, because prose and code samples are full of password: ….
• Noise is filtered out. Haul drops placeholders (your-token-here), references (${DB_PASSWORD}, op://…), UUIDs, paths, URLs and token counters (max_tokens).
• Nothing is skipped. AI tools often write a whole conversation on one JSON line. Haul scans long lines in overlapping 64 KB windows and streams large files, so memory stays flat.
• Optional offline validation. --verify-format checks structure (JWT expiry, key shapes, GitHub token checksums) to cut false positives further, entirely in memory.

Severity and scoring

Every finding gets a 0–100 score: a base severity, moved by how exposed the secret really is. The bands are ≥ 85 Critical, ≥ 65 High, ≥ 40 Medium and ≥ 20 Low; anything lower is Info. The worst severity becomes the exit code.

A finding tells you everything except the secret:

• its type, file, line, and how many times it occurs
• a non-reversible preview: a domain-separated SHA-256 fingerprint, plus the first 4 characters only for long random tokens, where they merely name the provider (ghp_, AKIA). Passwords never show a single character.
• its protection (passphrase, DPAPI, master password, none), inferred scope (a long-lived AKIA key vs. a temporary ASIA one), and a concrete fix

Reports

Write several at once into a folder:

haul -f terminal -f html -f json -f csv -f sarif -o ./reports

{
  "tool": "haul",
  "version": "0.2.0",
  "schema": 2,
  "summary": {
    "total": 20, "unique_secrets": 15, "files_scanned": 5,
    "by_severity": { "Critical": 11, "High": 4, "Medium": 5, "Low": 0, "Info": 0 },
    "highest_severity": "Critical", "exit_code": 4, "elapsed_seconds": 0.02
  },
  "findings": [
    {
      "secret_type": "AWS Access Key ID",
      "severity": "Critical", "score": 92,
      "file": "C:\\Users\\dev\\.aws\\credentials", "line": 2, "occurrences": 1,
      "preview": "AKIA…[sha256:a108299cdc4e len=20]",
      "fingerprint": "a108299cdc4e",
      "protection": "none", "scope": "long-lived IAM user key",
      "remediation": "Prefer `aws sso login` / IAM Identity Center or short-lived STS credentials; …",
      "baseline_key": "cloud-cli|AWS Access Key ID|C:\\Users\\dev\\.aws\\credentials|a108299cdc4e"
    }
  ],
  "errors": []
}

Command-line reference

Use it in CI

Haul makes a good gate. Fail on High or worse, and send SARIF to GitHub code scanning. Paths are relative to the folder Haul runs in, so findings land on the right files.

name: secrets
on: [push, pull_request]
permissions:
  contents: read
  security-events: write
jobs:
  haul:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install haul-scanner
      - name: Scan the repository
        run: haul --only dotenv,sensitive-files -f sarif -o haul.sarif --fail-on high -q "$GITHUB_WORKSPACE"
      - if: always()
        uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: haul.sarif }

Baselines accept known findings and fail only on new ones. They ignore line numbers, so editing a file doesn't bring an accepted finding back:

haul -f json -o baseline.json        # record today's state once
haul --baseline baseline.json        # from now on, only new findings

Cleaning AI-chat history

A key pasted into an AI chat stays in its transcript for good. --clean removes it. This is the only mode that writes to disk, and it is deliberately careful:

• A dry run by default. It lists what would change. Rewriting needs --apply, then typing redact (or --yes).
• History only. It never touches configs, a tool's own login file (that would log you out) or SQLite stores, and only works on regular files you own inside your home.
• Byte-exact. It works on raw bytes, so line endings and encodings survive unchanged. Whole private-key blocks are redacted, not just their first line.
• Backup first. It writes a backup with the same permissions, never overwrites an earlier one, replaces the file atomically, and backs off if the file changes mid-way.
• Never discloses. Each secret becomes a non-reversible marker: «haul-redacted:sha256:…».

Rotate first. The *.haul-bak-* backups still contain the original secrets. Rotate the exposed credentials, then delete the backups. Redaction is cleanup, not remediation.

Safety model

A tool that knows where every secret lives must be impossible to turn into a stealer. Haul enforces that in layers, each of which would stop a leak on its own:

The full threat model, and its honest limits, is in SECURITY.md.

Inside the package

One focused package, written against the standard library only and fully typed. Each layer has a single job:

Plugins

Third-party scanners plug in through an entry point and load only with --allow-plugins. They inherit every safety layer above, including the network kill-switch.

from collections.abc import Iterator

from haul.core.context import ScanContext
from haul.core.models import Finding, ScanCategory
from haul.core.registry import register
from haul.scanners.base import Scanner


@register
class MyToolScanner(Scanner):
    name = "my-tool"
    category = ScanCategory.CLOUD_CLI
    description = "Credentials written by my-tool"

    def scan(self, ctx: ScanContext) -> Iterator[Finding]:
        path = ctx.home_path(".mytool", "config")
        if path.is_file():
            yield from self.scan_file(ctx, path, remediation="Run `mytool login --keychain`.")

[project.entry-points."haul.scanners"]
my-tool = "my_package.haul_plugin"

Performance

FAQ

Limitations

• Heuristic by nature. Expect occasional false positives and misses. --verify-format and baselines help.
• The working tree only. Git history beyond the index is out of scope.
• Presence-only stores (browsers, gcloud and Azure caches, key stores) are reported, never inspected.
• No Windows Registry reads. WinSCP sessions stored in the registry, for example, are not covered.
• Defense in depth, not a sandbox. The kill-switch binds everything that goes through Python's audit layer; native extension code could bypass it, which is why plugins are opt-in.

Security

Found a way to make Haul emit, copy or transmit a secret, reach the network, or write outside --clean's scope? Please report it privately through a security advisory, not a public issue.

Reports are sensitive too. They contain no secret values, but they are a precise map of where secrets live on a machine. Store and share them like any sensitive document.

License

Free to use, all rights reserved. Haul is proprietary freeware © 2026 Arman Manteghi.

The binding text is in LICENSE.

_{Built by Arman Manteghi
Read-only · zero network · zero dependencies · no secret ever leaves the process}