🛡️ SecretShield
Your secrets shouldn't end up in your terminal, your logs, or your commit history.
Install · Demo · Try it · Homepage 🌐 · Full usage guide →
You've done this. Everyone has: a stray print() left in from
debugging, a log line that dumps a config dict, a hardcoded key that
slips past review. SecretShield catches it before it leaves your
machine — redacted from your terminal output automatically, scanned
out of your codebase on demand, and blocked from your commits if it
gets that far.
Demo
▶ Watch the full demo on YouTube
Install
pip install secretshield
Try it
import secretshield
api_key = "sk-example1234567890abcdefFAKEKEY"
print("API key:", api_key)
API key: ********
⚠ secretshield: Potential secret detected and redacted.
No config, no code changes — the moment you import it, stdout, stderr,
and logging are protected.
Scan a project:
secretshield scan .
Set a project up in one step — config file, Git hook, CI workflow:
secretshield init
(Every command also works via the shorter ss alias.)
What it does
| 🖥️ Runtime protection | import secretshield redacts secrets from stdout, stderr, and logging automatically |
| 🔍 Static scanning | secretshield scan . finds hardcoded secrets across Python, JS/TS, HTML, YAML, .env, and more |
| 🔧 Auto-Fix | scan . --fix moves a hardcoded Python or JS/TS secret into .env and rewrites the code — only when it's unambiguous |
| 🪝 Git hook | install-hook blocks a commit before a secret reaches your history |
| ⚙️ GitHub Actions | github-action generates a workflow that scans every push and PR |
No required dependencies, no telemetry, no network calls. Everything runs locally, in your own process.
Custom rules
Have a credential format of your own? Drop a
.secretshield-rules.toml in your project root:
[[rules]]
name = "My API Key"
pattern = "MYAPP_[A-Za-z0-9]{32}"
secretshield scan . picks it up automatically — no flag needed. The
rules file itself is never treated as project content to scan, so a
pattern that resembles a real secret won't flag its own definition.
Validate rules with secretshield rules check, create one
interactively with secretshield rule create, or try a pattern against
sample text with secretshield rule test before committing to it.
For the full command reference, configuration options, and exactly how Auto-Fix decides what's safe to rewrite, see the usage guide.
Limitations
Runtime protection covers this Python process's stdout/stderr/
logging — not screenshots, the clipboard, or other applications.
Auto-Fix only rewrites Python and JS/TS, and only unambiguous
assignments; anything less certain is reported, not modified. Treat
SecretShield as a strong safety net, not a replacement for proper
secret management. Details in the usage guide.
Contributing
Issues and PRs welcome. Add tests for new detection patterns or
behavior changes, use only fake credentials in tests/examples, and run
pytest before opening a PR.
☕ Get me a coffee
If you find this project useful, consider supporting its development through GitHub Sponsors.
License
MIT — see LICENSE.
Homepage
Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
1 maintainer
Metadata
1 maintainer
Release files for secretshield 0.9.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| secretshield-0.9.0.tar.gz | 69.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| secretshield-0.9.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 118.3 kB
Release files / secretshield-0.9.0.tar.gz
| Download URL | secretshield-0.9.0.tar.gz |
|---|---|
| Size | 69.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
105e6d33cfe1404bab535bbaea42bb7f91723b7fbf441e87de798151fa97a4b3
|
|
BLAKE2b-256 checksum How to use checksums |
22e3f8d5789ddce15873064d1242540bb571368eae9a531561d10bfeeb7ec24a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.2
|
Release files / secretshield-0.9.0-py3-none-any.whl
| Download URL | secretshield-0.9.0-py3-none-any.whl |
|---|---|
| Size | 49.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c454ca288a98d3a1ea6dc2c67baf0ada320b5ebc9a74adc645c86acf96f28c2e
|
|
BLAKE2b-256 checksum How to use checksums |
442e80262bd0aee188d4732888190d66ff3d50ee78e0e11a931d7930642912de
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.2
|
