secretscan

A personal security-hygiene tool: scans your own machine for accidentally exposed secrets (API keys, tokens, passwords, private keys), audits what's installed and what's exposed (Docker containers, listening ports), and can optionally check your local network and internet connectivity.

Install

pip install .

Or for development:

pip install -e .

Usage

# default scan: everything except lan/internet, print a table
secretscan run

# scan a specific directory, filesystem module only
secretscan run --paths ~/Projects --modules filesystem

# full scan including LAN and internet, all formats
secretscan run --modules filesystem,shell-history,keychain,process-env,installed-tools,network,docker,lan,internet \
  --yes-lan --format table,json,html --output-dir ./report

# list all detection rules
secretscan rules list

# use a custom rules file
secretscan run --rules-file my-rules.yaml

Modules

Output formats

• table — colored terminal output (default)
• json — machine-readable {meta, findings} document
• html — self-contained HTML report with dark/light theme
• csv — flat CSV of findings

Detection

14 built-in rules covering AWS, GitHub, GitLab, Slack, Stripe, Google, npm, PEM private keys, and generic password/secret/token assignments. Each rule uses regex matching with optional Shannon entropy scoring and keyword pre-filtering for performance.

Values that look like placeholders ({{password}}, changeme, your_api_key_here) are detected and downgraded rather than competing with real findings.

What this tool does NOT do

• No git-history scanning (use Gitleaks/TruffleHog for that)
• No live credential verification
• No bypassing macOS security prompts
• Secret detection modules never make outbound network calls