secretsweep

A fast, dependency-free CLI to scan files and directories for leaked secrets: API keys, tokens, private keys, passwords, and database connection strings.

What it does

Recursively walks a file or directory and checks every line of every text file against a set of pattern rules (AWS keys, GitHub/Slack/Stripe/Google tokens, JWTs, PEM private key blocks, hardcoded passwords, DB connection strings with embedded credentials), plus an optional high-entropy fallback for values assigned to suspicious-looking variable names (e.g. my_token = "...").

Matched secrets are redacted in all output (first 4 / last 4 characters shown, middle replaced with ...) — the raw secret value is never printed.

Binary files, common vendor/build directories (.git, node_modules, dist, etc.), and files over 5MB are skipped automatically.

Install

npm install -g @danny1214/secretsweep
secretsweep --help

Requires Node.js >= 14. No dependencies.

From source (contributing / local dev only)

git clone <this-repo>
cd secretsweep
chmod +x bin/secretsweep.js
node bin/secretsweep.js --help

Usage

secretsweep <path> [options]

Options:

• --json — output findings as JSON instead of human-readable text
• --no-entropy — disable the high-entropy fallback detector (fewer false positives, may miss unknown secret formats)
• --severity <level> — only show findings at or above this severity: critical, high, medium, low (default: low, shows everything)
• -h, --help — show help

Exit codes: 0 = no findings, 1 = findings detected, 2 = invalid usage.

Example

$ secretsweep ./test/fixtures
Scanned 2 file(s), skipped 0, total 2.

[CRITICAL] /path/test/fixtures/leaky.txt:5 (private-key-block)
  PEM-format private key block
  match: -----...KEY-----
  context: -----BEGIN RSA PRIVATE KEY-----

[HIGH] /path/test/fixtures/leaky.txt:2 (aws-secret-key)
  ...

Found 5 potential secret(s).

Running tests

npm test

Expected output: 8 passed, 0 failed.

Limits

• Pattern-based, not perfect. Rules match known secret formats (AWS, GitHub, Slack, Stripe, Google, JWT, PEM keys) plus generic password/API-key/connection-string patterns. Novel or obfuscated secret formats can be missed. This is a triage tool, not a guarantee.
• False positives are possible, especially from the entropy fallback detector on non-secret high-entropy strings (hashes, encoded IDs, etc.). Use --no-entropy to reduce noise, or --severity high to focus on higher-confidence rule matches.
• No git history scanning. Only scans the current state of files on disk, not prior commits. A secret that was committed and later removed will not be found by this tool.
• Line-based matching only. Secrets split across multiple lines (other than the explicitly handled PEM key block) will not be detected.
• Not a replacement for secret rotation. If secretsweep finds something, treat the credential as compromised and rotate it — don't just remove it from the file.

License

MIT