secretsaudit

Zero-config CLI that scans your node_modules for hardcoded secrets, API keys, tokens, and passwords.

npm audit checks for known vulnerabilities — secretsaudit checks if your dependencies are shipping secrets.

Install

npx secretsaudit

Usage

# Scan node_modules in current directory
npx secretsaudit

# Scan a specific project
npx secretsaudit --path /path/to/project

# JSON output for CI pipelines
npx secretsaudit --json

# Only show high severity findings
npx secretsaudit --severity high

# Ignore specific packages
npx secretsaudit --ignore some-package another-package

# Combine flags
npx secretsaudit --json --severity medium

What It Detects

| Category | Secrets | |----------|---------| | Cloud Providers | AWS keys, Google API keys, Azure keys, Heroku keys | | GitHub | Personal access tokens, OAuth tokens, app tokens | | Payment | Stripe keys, Twilio keys | | Communication | Slack tokens/webhooks, Discord tokens, Telegram tokens | | Database | MongoDB, PostgreSQL, MySQL, Redis connection URIs | | Auth | Passwords, JWT secrets, bearer tokens, API keys | | NPM | .npmrc auth tokens, registry tokens | | Other | Private keys, SendGrid keys, Mailgun keys, Firebase URLs |

Why

• npm audit checks CVEs, not secrets in dependency code
• trufflehog / gitleaks scan repos, not installed node_modules
• secretsaudit fills the gap — scans what's actually installed

Exit Codes

• 0 — No secrets found
• 1 — Secrets found
• 2 — Error (no node_modules found, etc.)

CI Integration

# GitHub Actions
- name: Audit dependencies for secrets
  run: npx secretsaudit --json --severity medium

License

MIT