n0s1 - Secret Scanner
n0s1 (pronunciation) is a secret scanner for Slack, Jira, Confluence, Asana, Wrike, Linear, Zendesk, GitHub and GitLab. It scans all channels/tickets/items/issues within the target platform in search of any leaked secrets in the titles, bodies, messages and comments. It is open-source and it can be easily extended to support scanning many others ticketing and messaging platforms.
See USER_MANUAL.md to learn how to run a scan.
Secrets are defined by an adaptable configuration file: regex.yaml. The scanner loads the configuration and searches for sensitive information, which includes:
- Github Personal Access Tokens
- GitLab Personal Access Tokens
- AWS Access Tokens
- PKCS8 private keys
- RSA private keys
- SSH private keys
- npm access tokens
Currently supported target platforms:
Install
python3 -m ensurepip --upgrade
python3 -m pip install --upgrade n0s1
n0s1 --help
Quick Start
python3 -m pip install n0s1
n0s1 jira_scan --server "https://<YOUR_JIRA_SERVER>.atlassian.net" --email "your-email@company.com" --api-key "<YOUR_JIRA_API_TOKEN>"
docker run spark1security/n0s1 jira_scan --server "https://<YOUR_JIRA_SERVER>.atlassian.net" --email "your-email@company.com" --api-key "<YOUR_JIRA_API_TOKEN>"
claude mcp add --scope user n0s1 -- uvx n0s1-mcp
claude "Scan my Jira project IT for leaked secrets"
git clone https://github.com/spark1security/n0s1.git
cd n0s1
python3 -m venv n0s1_python
source n0s1_python/bin/activate
pip install -e .
n0s1 jira_scan --server "https://<YOUR_JIRA_SERVER>.atlassian.net" --email "your-email@company.com" --api-key "<YOUR_JIRA_API_TOKEN>"
deactivate
Python SDK - See SDK_GUIDE.md:
python3 -m pip install n0s1
try:
import scanner
except:
import n0s1.scanner as scanner
# Create scanner instance
scanner_instance = scanner.SecretScanner(
target="jira_scan",
server="https://yourcompany.atlassian.net",
email="your-email@company.com",
api_key="your-jira-api-token",
debug=True
)
# Run the scan
result = scanner_instance.scan()
# Process results
print(f"Scan complete. Found {len(result.get('findings', {}))} potential secrets")
jobs:
jira_secret_scanning:
steps:
- uses: spark1security/n0s1-action@main
env:
JIRA_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
with:
scan-target: 'jira_scan'
user-email: 'service_account@<YOUR_COMPANY>.atlassian.net'
platform-url: 'https://<YOUR_COMPANY>.atlassian.net'
GitLab CI - Add the following job to your .gitlab-ci.yml file:
jira-scan:
stage: test
image:
name: spark1security/n0s1
entrypoint: [""]
script:
- n0s1 jira_scan --email "service_account@<YOUR_COMPANY>.atlassian.net" --api-key $JIRA_TOKEN --server "https://<YOUR_COMPANY>.atlassian.net" --report-file gl-dast-report.json --report-format gitlab
- apt-get update
- apt-get -y install jq
- cat gl-dast-report.json | jq
artifacts:
reports:
dast:
- gl-dast-report.json
AI Agents
| Resource | Description |
|---|---|
tool-schema.json |
Tool-use / function-calling schema (Anthropic & OpenAI compatible). Load this to give an AI agent the ability to invoke n0s1 as structured tool calls. |
docs/ai.md |
AI-optimized reference covering all interfaces: CLI, Docker, Python SDK, GitHub Actions, and MCP server. |
Want more? Check out Spark 1
If you liked n0s1, you will love Spark 1 which builds on top of n0s1 to provide even more enhanced capabilities for a complete security management offering.
Don't forget to check out the https://spark1.us website for more information about our products and services.
If you'd like to contact Spark 1 or request a demo, please use the free consultation form.
Community
n0s1 is a Spark 1 open source project.
Learn about our open source work and portfolio here.
Contact us about any matter by opening a GitHub Discussion here
1 maintainer
Metadata
1 maintainer
Release files for n0s1 1.2.7
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| n0s1-1.2.7.tar.gz | 124.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| n0s1-1.2.7-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 260.9 kB
Release files / n0s1-1.2.7.tar.gz
| Download URL | n0s1-1.2.7.tar.gz |
|---|---|
| Size | 124.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2bbf485f148aeb63210cba52f6b3d1e29476acea5dccbcc9f41122c60d0adf8a
|
|
BLAKE2b-256 checksum How to use checksums |
0c787a717042e520d416fb107462458ddcf51a9be2b1c7716f34173178bbfbec
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 13, 2026.
Transparency logRelease files / n0s1-1.2.7-py3-none-any.whl
| Download URL | n0s1-1.2.7-py3-none-any.whl |
|---|---|
| Size | 136.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
82440c61d5780d360950be97cd6d92c638e3d4be7a0fa363fe543f40bbd15338
|
|
BLAKE2b-256 checksum How to use checksums |
b41cdbf5fda0c2ce961160aa24d157ed72ea0c3e40c0840ecf32e5046dfd3277
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 13, 2026.
Transparency log
