Identify hardcoded secrets in static structured text
The main features of skyscanner/whispers are: Identity and Access Management, Offensive Security Tools, Secret Scanning.
Open-source alternatives to skyscanner/whispers include: zricethezav/gitleaks — Gitleaks is a static analysis security tool and secret detection engine designed to find hardcoded passwords, API… yelp/detect-secrets — detect-secrets is a modular secret scanning tool that identifies hard-coded credentials and sensitive information in… bishopfox/dufflebag — Search exposed EBS volumes for secrets. dxa4481/trufflehog — TruffleHog is a secret scanning tool designed to identify leaked credentials and API keys across version control… v2-dev/awesome-social-engineering — This project is a curated collection of frameworks, libraries, and toolsets designed for social engineering and public… skerkour/black-hat-rust — This project is an offensive security toolkit and development framework for creating memory-safe malware, network…
detect-secrets is a modular secret scanning tool that identifies hard-coded credentials and sensitive information in source code. It combines multiple detection strategies—regular expression pattern matching, Shannon entropy calculation, and a machine learning classifier—to find potential secrets, and uses a baseline-driven delta analysis to distinguish newly introduced secrets from pre-existing ones, reducing noise from legacy credentials. The tool integrates directly into development workflows through a git pre-commit hook that blocks commits introducing unbaselined secrets, and can be inco
TruffleHog is a secret scanning tool designed to identify leaked credentials and API keys across version control systems, cloud storage, and filesystems. It functions as a git secret detector that enumerates hidden commits and a cloud storage security auditor for inspecting container images and storage buckets. The project is distinguished by a credential verification engine that tests discovered secrets against service APIs to confirm they are active, which eliminates false positive alerts. It further analyzes these verified credentials to determine the specific access levels and resources t
Gitleaks is a static analysis security tool and secret detection engine designed to find hardcoded passwords, API keys, and authentication tokens. It functions as a Git secret scanner that analyzes both local file systems and Git commit history to prevent credential leaks. The tool distinguishes itself through a decoding pipeline that transforms base64 and hex strings into plaintext to find obfuscated secrets. It further reduces false positives using proximity-based validation and fingerprint-based suppression to filter out known or baseline findings. The system covers a broad range of detec
