secret-scan-lite 1.0.0

Fast CLI scanner for secrets and credentials in git staged files and directories

secret-scan-lite

Fast CLI scanner that detects secrets and credentials in git staged files before they hit your history.

Install

pip install secret-scan-lite

Usage

# Scan staged files only (git pre-commit default)
secret-scan

# Scan a specific directory
secret-scan --path ./src

# Scan entire working tree
secret-scan --all

Exit codes

Code	Meaning
0	Clean — no secrets found
1	Secrets detected — git will abort the commit
2	Error (not a git repo, git not installed, etc.)

Detected patterns

Pattern	Severity
AWS Access Key ID (AKIA…)	HIGH
AWS Secret Access Key	HIGH
Generic password / secret / token assignment	HIGH
RSA / EC / OpenSSH Private Key	HIGH
Telegram Bot Token	HIGH
GitHub PAT (classic & fine-grained)	HIGH
Slack Bot / App Token	HIGH
Stripe Secret Key	HIGH
Google API Key	HIGH
Basic Auth in URL	MEDIUM
Generic Bearer Token	MEDIUM

Use as a pre-commit hook

Add to your .pre-commit-config.yaml:

repos:
  - repo: local
    hooks:
      - id: secret-scan
        name: Scan for secrets
        entry: secret-scan
        language: system
        stages: [commit]
        pass_filenames: false

Install hooks:

pip install pre-commit
pre-commit install

License

MIT