deepfence/SecretScanner
SecretScanner
SecretScanner is a security tool designed to search filesystems and container images for unprotected passwords, API keys, and other sensitive data. It functions as a static secret detector and container image scanner that identifies hardcoded credentials by matching content against a database of known secret types.
The tool inspects container image layers to find secrets hidden within the filesystem hierarchy and parses local directories and host-mounted paths. It provides the ability to export scan findings in machine-readable JSON format for automated analysis and processing.
The scanning engine utilizes pattern-based string matching and multi-threaded file traversal to process data. Users can adjust scan parameters such as thread counts, file size limits, and path exclusions to manage the scope and performance of the search.
Features
- Secret Detection - Identifies and prevents the exposure of sensitive credentials across files and container images.
- Secrets Scanning - Provides a security tool for detecting hardcoded credentials and sensitive data across filesystems and container image layers.
- Credential Auditing - Scans Docker and OCI images for hardcoded credentials before deployment to production.
- Secret Detection - Scans container images specifically for the presence of sensitive credentials.
- Container Security Scanners - Inspects container image layers to identify hardcoded secrets and sensitive credentials.
- Pattern Matching Detectors - Implements static analysis of local files and directories using pattern-based string matching to identify sensitive data.
- Filesystem Scanning - Parses directories and host-mounted paths to identify secrets stored in files on the local machine.
- Sensitive File Discovery - Actively enumerates local directories and host systems to locate unprotected secrets.
- Secret Scanning - Searches pulled container images for unprotected secrets by matching contents against a database of known sensitive data types.
- Secret Pattern Matching - Uses regular expressions to identify specific formats of sensitive credentials like API keys and passwords.
- DevSecOps and Automation - Automates the discovery of sensitive data in filesystems and images as part of security standards in development.
- Scan Result Exporters - Writes identified secrets to specified output formats like JSON or tables for downstream analysis.
- Layer Inspection - Deconstructs pulled container images into their constituent layers to scan for secrets hidden within the filesystem hierarchy.
- Machine-Readable Vulnerability Exports - Outputs security scan findings in structured JSON format to facilitate automated processing.
- Application Security - Finds secrets and passwords in containers and filesystems.
- Container and Cluster Security - Scanner for detecting unprotected secrets and keys in containers.
- Security & Privacy - Scans container images and filesystems for leaked secrets.
- Vulnerability Scanning - Tool for finding secrets in container images and filesystems.
