You've done this. Everyone has: a stray print() left in from debugging, a log line that dumps a config dict, a hardcoded key that slips past review. SecretShield catches it before it leaves your machine — redacted from your terminal output automatically, scanned out of your codebase on demand, and blocked from your commits if it gets that far.

Demo

▶ Watch the full demo on YouTube

Install

pip install secretshield

Try it

import secretshield

api_key = "sk-example1234567890abcdefFAKEKEY"
print("API key:", api_key)

API key: ********
⚠ secretshield: Potential secret detected and redacted.

No config, no code changes — the moment you import it, stdout, stderr, and logging are protected.

Scan a project:

secretshield scan .

Set a project up in one step — config file, Git hook, CI workflow:

secretshield init

(Every command also works via the shorter ss alias.)

What it does

No required dependencies, no telemetry, no network calls. Everything runs locally, in your own process.

For the full command reference, configuration options, and exactly how Auto-Fix decides what's safe to rewrite, see the usage guide.

Limitations

Runtime protection covers this Python process's stdout/stderr/ logging — not screenshots, the clipboard, or other applications. Auto-Fix only rewrites Python and JS/TS, and only unambiguous assignments; anything less certain is reported, not modified. Treat SecretShield as a strong safety net, not a replacement for proper secret management. Details in the usage guide.

Contributing

Issues and PRs welcome. Add tests for new detection patterns or behavior changes, use only fake credentials in tests/examples, and run pytest before opening a PR.

☕ Get me a coffee

If you find this project useful, consider supporting its development through GitHub Sponsors.

License

MIT — see LICENSE.