secret-scan

Scans files and git history for accidentally committed secrets. Zero dependencies — runs with npx secret-scan.

Detects API keys, tokens, passwords, private keys, and database credentials across 20+ patterns.

Why?

gitleaks and truffleHog are the gold standard but require Go/Python installation. secret-scan is a single Node.js file. If you have Node.js, you can run it right now.

Install

npm install -g secret-scan

Or without installing:

npx secret-scan

Usage

# Scan current directory
secret-scan

# Scan a specific project
secret-scan ./backend

# Also scan the last 100 commits in git history
secret-scan --git

# CI mode — exit 1 on any finding
secret-scan --strict

# JSON output
secret-scan --json

Example Output

secret-scan  my-app
  Scanned 87 files

  ✘ 3 potential secret(s) found:

  HIGH:
    Stripe Secret Key            src/payments.js:12
      sk_live_…****************************

    Database URL (with password) config/database.js:5
      postgres://user:****@localhost/mydb

  MEDIUM:
    JWT Token                    test/fixtures/auth.js:8
      eyJh…****

  Snippets are redacted. Review the flagged files manually.

What It Detects

| Secret Type | Severity | |---|---| | Private keys (RSA, EC, OpenSSH) | HIGH | | AWS Access Key / Secret Key | HIGH | | Stripe secret key (sk_live_, sk_test_) | HIGH | | Google API key (AIza…) | HIGH | | GitHub tokens (ghp_, gho_, ghs_) | HIGH | | Slack tokens (xox*) | HIGH | | SendGrid API key | HIGH | | NPM publish token | HIGH | | Telegram bot token | HIGH | | Database URLs with passwords | HIGH | | Heroku API key | HIGH | | Square access token | HIGH | | Stripe publishable key | MEDIUM | | Slack webhook URL | MEDIUM | | JWT token | MEDIUM | | Twilio account SID | MEDIUM | | Hardcoded passwords in code | MEDIUM | | Hardcoded API keys in code | MEDIUM |

CI Integration

# .github/workflows/security.yml
name: Secret Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 50   # for --git history scan
      - run: npx secret-scan --git --strict

Git History Scan

With --git, secret-scan scans the added lines in the last 100 commits. This catches secrets that were added and later removed — they're still in the history.

secret-scan --git

# Findings like:
  AWS Access Key   git:a3f7c2d:23
    AKIA…****

Use git show a3f7c2d to inspect the full commit, then consider removing the secret from history.

False Positives

Some patterns (JWT, hardcoded passwords) may flag test fixtures or example values. Review flagged lines manually. The --strict flag is not recommended if you have many test fixtures.

License

MIT

Keywords

secret scanner · credential leak · api key detection · gitleaks alternative · trufflehog alternative · detect secrets · password scan · aws key · zero dependencies · security

Built to solve, shared to help — Rushabh Shah 🛠️✨

One of 40+ zero-dependency developer CLI tools — no node_modules, ever.