secrets-scan-cli

Scan any project directory for accidentally committed secrets, credentials, and API keys. Catches AWS keys, GitHub tokens, Stripe keys, Google API keys, private keys, JWTs, passwords, and more — all from your terminal, with zero configuration.

Install

npm install -g secrets-scan-cli

Usage

# Scan current directory
secrets-scan

# Scan a specific project
secrets-scan /path/to/project

# Show only high-severity findings
secrets-scan --severity high

# Output JSON (useful for CI/CD pipelines — exits 1 if secrets found)
secrets-scan --json

# Skip .env files (scan all other files)
secrets-scan --skip-env

# Combine flags
secrets-scan ./my-repo --severity high --json

What it detects

| Pattern | Severity | |---|---| | AWS Access Key (AKIA...) | HIGH | | GitHub Token (ghp_, github_pat_) | HIGH | | Stripe Live Key (sk_live_...) | HIGH | | Google API Key (AIza...) | HIGH | | SendGrid Key (SG....) | HIGH | | Mailgun Key (key-...) | HIGH | | Private Key headers (-----BEGIN ...) | HIGH | | Basic Auth in URLs (http://user:pass@) | HIGH | | npm Token (npm_...) | HIGH | | Firebase Key | HIGH | | Slack Token (xox...) | HIGH | | Generic secret=, token=, api_key= | MEDIUM | | Generic password= | MEDIUM | | Stripe Test Key (sk_test_...) | MEDIUM | | JWT tokens | MEDIUM | | Twilio SID/Token | MEDIUM | | UUID patterns | LOW |

Example output

Secrets scan of /home/user/my-project

[HIGH] src/config.js:14  AWS Access Key
       const key = "AKIAIOSFODNN7EXAMPLE";

[MEDIUM] .env.backup:3  Generic Secret
       api_key=abcdef1234567890abcdef1234567890

────────────────────────────────────────────────────────────
Found 2 potential secret(s): 1 high, 1 medium, 0 low
Review each finding and rotate any real credentials immediately.

CI/CD integration

secrets-scan exits with code 1 when secrets are found, 0 when clean. Use --json for machine-readable output:

# GitHub Actions example
- name: Scan for secrets
  run: npx secrets-scan-cli --severity high --json

What it skips

• node_modules/, .git/, dist/, build/, vendor/
• Binary files (images, archives, compiled binaries, fonts)
• Files over 1MB
• Lock files (package-lock.json, yarn.lock)

License

MIT