🛡️ SecretShield
Your secrets shouldn't end up in your terminal, your logs, or your commit history.
Install · Demo · Try it · Homepage 🌐 · Full usage guide →
You've done this. Everyone has: a stray print() left in from
debugging, a log line that dumps a config dict, a hardcoded key that
slips past review. SecretShield catches it before it leaves your
machine — redacted from your terminal output automatically, scanned
out of your codebase on demand, and blocked from your commits if it
gets that far.
Demo
▶ Watch the full demo on YouTube
Install
pip install secretshield
Try it
import secretshield
api_key = "sk-example1234567890abcdefFAKEKEY"
print("API key:", api_key)
API key: ********
⚠ secretshield: Potential secret detected and redacted.
No config, no code changes — the moment you import it, stdout, stderr,
and logging are protected.
Scan a project:
secretshield scan .
Set a project up in one step — config file, Git hook, CI workflow:
secretshield init
(Every command also works via the shorter ss alias.)
What it does
| 🖥️ Runtime protection | import secretshield redacts secrets from stdout, stderr, and logging automatically |
| 🔍 Static scanning | secretshield scan . finds hardcoded secrets across Python, JS/TS, HTML, YAML, .env, and more |
| 🔧 Auto-Fix | scan . --fix moves a hardcoded Python or JS/TS secret into .env and rewrites the code — only when it's unambiguous |
| 🔄 Rotation assistant | scan . --rotate walks you through revoking a leaked credential with its provider, replacing it, and checking for leftover copies — it never revokes anything itself |
| 🪝 Git hook | install-hook blocks a commit before a secret reaches your history |
| ⚙️ GitHub Actions | github-action generates a workflow that scans every push and PR |
No required dependencies, no telemetry, no network calls. Everything runs locally, in your own process.
Custom rules
Have a credential format of your own? Drop a
.secretshield-rules.toml in your project root:
[[rules]]
name = "My API Key"
pattern = "MYAPP_[A-Za-z0-9]{32}"
secretshield scan . picks it up automatically — no flag needed. The
rules file itself is never treated as project content to scan, so a
pattern that resembles a real secret won't flag its own definition.
Validate rules with secretshield rules check, create one
interactively with secretshield rule create, or try a pattern against
sample text with secretshield rule test before committing to it.
For the full command reference, configuration options, and exactly how Auto-Fix decides what's safe to rewrite, see the usage guide.
Limitations
Runtime protection covers this Python process's stdout/stderr/
logging — not screenshots, the clipboard, or other applications.
Auto-Fix only rewrites Python and JS/TS, and only unambiguous
assignments; anything less certain is reported, not modified. Treat
SecretShield as a strong safety net, not a replacement for proper
secret management. Details in the usage guide.
Contributing
Issues and PRs welcome. Add tests for new detection patterns or
behavior changes, use only fake credentials in tests/examples, and run
pytest before opening a PR.
☕ Get me a coffee
If you find this project useful, consider supporting its development through GitHub Sponsors.
License
MIT — see LICENSE.
Homepage
Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
1 maintainer
Metadata
1 maintainer
Release files for secretshield 0.12.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| secretshield-0.12.0.tar.gz | 111.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| secretshield-0.12.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 183.9 kB
Release files / secretshield-0.12.0.tar.gz
| Download URL | secretshield-0.12.0.tar.gz |
|---|---|
| Size | 111.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
34df4787ba28dee117e56cc90eb5a64dce62e9f936ac0ffcaef1c7bbe7e2f268
|
|
BLAKE2b-256 checksum How to use checksums |
8f007f0ab29ec307df1fdc658c6dc0e2b37a917bf616ff67696eb7b127d79863
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.2
|
Release files / secretshield-0.12.0-py3-none-any.whl
| Download URL | secretshield-0.12.0-py3-none-any.whl |
|---|---|
| Size | 72.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
55dc76aeb9853f6cfd46a048fff2e2ce09a0ffda4b3c5d4a0ba2a90268cb53f7
|
|
BLAKE2b-256 checksum How to use checksums |
a3c1538589f50b523ffa9142d5b3d50ff0cf75c48d8cfcf19eac42a2e0985648
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.2
|
