SecretSieve

Sieve the secrets out of your source.

SecretSieve is a professional, intelligent, local-first secret detection CLI written in Python. It scans source code, configuration files, and project directories for accidentally exposed credentials - API keys, tokens, private keys, passwords, and connection strings - using a multi-signal engine (signatures + entropy + context + deterministic confidence/severity scoring), not just regex.

Copyright © 3rabDev - https://3rabdev.online

License: MIT - see LICENSE. Copyright © 3rabDev.

Privacy

• 100% local by default. No network I/O during scanning, no uploads, no telemetry.
• Secrets are never verified against third-party services (that would transmit them).
• All output is redacted by default (AKIA****************9X2F).

Install

Requires Python 3.10+.

pip install secretsieve        # from PyPI (once released)
pipx install secretsieve       # isolated CLI install (recommended)
pip install -e .               # from source (developers)

Quick start

secretsieve .                                  # scan the current project
secretsieve ./src config.py                    # scan specific paths
secretsieve scan . --json --fail-on high       # CI-friendly JSON gate
secretsieve rules --list                       # show all detection rules
secretsieve explain SS-GITHUB-001              # understand a rule
secretsieve config --init > secretsieve.toml   # starter config

Exit codes (generic CI)

--fail-on defaults to low (any LOW+ fails; INFO never fails). --severity only controls display; hidden findings still fail CI.

Suppressing a false positive

Preferred order:

1. Verify it really is a false positive (placeholder? hash? test data?).
2. Suppress by fingerprint (stable, auditable) in secretsieve.toml:

   [[allow.fingerprint]]
   value = "sha256:..."
   

3. Or scope a rule+path:

   [[allow.path_rule]]
   rule = "SS-GENERIC-002"
   path = "tests/fixtures/**"
   

4. Or add a same-line comment (line scope only, visible in diffs):

   password = "not-a-real-secret-for-tests"  # secretsieve:ignore
   

Documentation

• Architecture · CLI reference · Install · Quick start · Configuration · Detection coverage · False positives · Privacy · Security · Contributing · Release process · Performance
• Master engineering blueprint: PLAN.md
• Changes: CHANGELOG.md