🔍 git-secrets-scanner

Scan git commit history for leaked secrets, API keys, and tokens by username. Find what was deleted but never truly gone.

🚀 What it does

Secrets accidentally committed to git never really disappear — even after deletion, they live on in the commit history. git-secrets-scanner (alias: gsec) digs through the commit history of a specific author and surfaces:

• 🔑 API keys (AWS, Google, Azure, Stripe, etc.)
• 🎟️ Tokens (GitHub, GitLab, Slack, Discord, JWT, Bearer)
• 🔐 Passwords (hardcoded in code or config files)
• 🗝️ Private keys (RSA, SSH, PGP)
• 🗄️ Database credentials (MongoDB, PostgreSQL, MySQL, Redis connection strings)
• 📦 Package registry tokens (npm, PyPI)
• 🧮 High-entropy strings (optional Shannon entropy analysis)

📦 Installation

# Install globally
npm install -g git-secrets-scanner

# Or run directly with npx
npx git-secrets-scanner scan --author "username"

🎯 Quick Start

# Scan current repo for secrets by a specific author
gsec scan --author "john.doe"

# Scan a specific repository
gsec scan --author "[email protected]" --repo /path/to/repo

# Export results as JSON
gsec scan --author "dev" --format json --output results.json

# Only show critical and high severity findings
gsec scan --author "dev" --severity high

# Enable entropy-based detection for unknown secret formats
gsec scan --author "dev" --entropy

🛠️ Usage

Usage: git-secrets-scanner scan [options]

Scan git commit history for secrets by a specific author

Options:
  -a, --author <name>       Git author name or email to filter (required)
  -r, --repo <path>         Path to git repository (default: ".")
  -f, --format <type>       Output format: table, json, csv (default: "table")
  -s, --severity <level>    Minimum severity: low, medium, high, critical (default: "low")
  -e, --entropy             Enable entropy-based detection (default: false)
  -o, --output <file>       Write results to a file
  -m, --max-commits <num>   Maximum number of commits to scan (default: "1000")
  -v, --version             Display version number
  -h, --help                Display help

📊 Output Formats

Table (Default)

Beautiful colored ASCII table with:

• Severity badges (🔴 Critical, 🟠 High, 🟡 Medium, 🔵 Low)
• Redacted secret values (first 4 chars visible)
• Status indicators (⚠ ACTIVE vs 🗑 REMOVED)
• Summary statistics box

JSON

Machine-readable output for CI/CD integration:

{
  "meta": {
    "tool": "git-secrets-scanner",
    "version": "1.0.0",
    "scanDate": "2024-01-15T10:30:00.000Z",
    "author": "developer",
    "totalCommitsScanned": 150
  },
  "summary": {
    "critical": 2,
    "high": 3,
    "medium": 1,
    "low": 0,
    "total": 6
  },
  "findings": [...]
}

CSV

Spreadsheet-friendly format for further analysis.

🔎 Detection Patterns

30+ patterns covering major services:

| Category | Services | |:---|:---| | Cloud | AWS, Google Cloud, Azure | | Source Control | GitHub (PAT, OAuth, App), GitLab | | Messaging | Slack, Discord, Telegram | | Payment | Stripe (secret, publishable, restricted) | | Auth | JWT, Bearer, Basic Auth | | Database | MongoDB, PostgreSQL, MySQL, Redis | | Private Keys | RSA, SSH (OpenSSH), PGP, EC, DSA | | Infrastructure | Twilio, SendGrid, Mailgun, Firebase, Heroku | | Registries | npm, PyPI | | Generic | api_key, secret, password, token assignments |

🧮 Entropy Detection

Use --entropy to enable Shannon entropy analysis. This catches high-randomness strings that don't match any known pattern — useful for custom tokens or secret formats.

🔒 Security

• Secrets are partially redacted in all outputs (first 4 characters visible + ****)
• The tool does not send any data externally
• All scanning happens locally on your machine
• Exit code 2 when critical/high secrets are found (for CI/CD pipelines)

🤝 CI/CD Integration

# GitHub Actions example
- name: Scan for secrets
  run: npx git-secrets-scanner scan --author "${{ github.actor }}" --format json --severity high --output scan-results.json
  
- name: Upload results
  if: failure()
  uses: actions/upload-artifact@v4
  with:
    name: secret-scan-results
    path: scan-results.json

📄 License

MIT © mannubaveja