Secret Scan CLI

Scan a local directory for likely leaked credentials (AWS keys, GitHub tokens, Slack tokens, private keys, generic api_key= assignments) -- offline, no dependencies. Python 3.8+, stdlib only (re, os, argparse). No network at runtime.

Install

pip install plainkitbin-secret-scan-cli

Usage

secret-scan-cli .
secret-scan-cli path/to/repo

Exits with code 1 if any finding is present, 0 otherwise (suitable for a pre-commit hook or CI check). Matches are redacted in the output (only the first/last 4 characters are shown).

What it detects

Fixed regex patterns for: AWS access keys, GitHub personal access tokens (ghp_...), Slack tokens (xox...), PEM-style private key blocks, and a generic api_key = "..." pattern.

Limitations

Pattern-based only -- no entropy analysis, no support for credential formats outside the five patterns above, and no historical git-log scanning (working tree only). This will miss credentials that do not match a known shape. It is a lightweight local check, not a substitute for a dedicated credential-scanning service.

Free and open source (MIT license, see LICENSE). No telemetry, no network calls, no nagware.

Part of the PlainKitBin toolset.

Provided as-is with no individual support.

Built with AI assistance and automatically tested before release; released under human oversight.