Yelp/detect-secrets
Detect Secrets
detect-secrets is a modular secret scanning tool that identifies hard-coded credentials and sensitive information in source code. It combines multiple detection strategies—regular expression pattern matching, Shannon entropy calculation, and a machine learning classifier—to find potential secrets, and uses a baseline-driven delta analysis to distinguish newly introduced secrets from pre-existing ones, reducing noise from legacy credentials.
The tool integrates directly into development workflows through a git pre-commit hook that blocks commits introducing unbaselined secrets, and can be incorporated into CI/CD pipelines for automated scanning during builds. Its plugin-based detection architecture allows loading modular detection plugins at runtime, each implementing a distinct scanning strategy, and supports custom plugins for organization-specific patterns. An audit trail mapping system records each detection verdict as a true or false positive entry, enabling downstream tracking of remediation progress and false positive suppression.
Additional capabilities include inline secret allowlisting to mark specific lines for the scanner to ignore, scan exclusion rules to reduce false positives by ignoring specific file paths or patterns, and secret audit labeling to interactively classify each detection and generate a migration checklist. The tool also manages a known secret baseline that creates and updates a snapshot of all currently detected secrets, allowing new secrets to be flagged while ignoring pre-existing ones.
Features
- Secrets Scanning - Identifies hard-coded credentials and sensitive information in source code using multiple detection strategies.
- Secret Scanning Hooks - Intercepts pre-commit events to run secret scans and block commits with unbaselined secrets.
- Secret Scanning Integrations - Integrates automated secret detection into continuous integration and deployment workflows.
- Secret Baseline Generation - Creates a reference snapshot of known secrets to distinguish new leaks from pre-existing ones.
- Detection Plugin Interfaces - Loads modular detection plugins at runtime, each implementing a distinct scanning strategy.
- Secret Pattern Matching - Scans file contents against curated regular expressions designed to match common credential formats.
- Plugin-Based Architectures - Loads modular detection plugins at runtime, each implementing a distinct scanning strategy.
- Secret Classifiers - Applies a trained model to identify secret-like patterns using contextual features beyond regex.
- Secret Detection Plugins - Loads user-defined secret detectors or filters to catch patterns not covered by the built-in rule set.
- Secret Entropy Detectors - Measures string randomness to identify high-entropy tokens likely to be cryptographic keys or passwords.
- Custom Detection Rules - Extends the scanner with custom detection logic for proprietary data formats or organization-specific patterns.
- Audit & Remediation Workflows - Labels scan results as true or false positives and tracks the rotation of leaked credentials.
- Regex-Based Exclusion Rules - Provides regex-based exclusion rules to reduce false positives during secret scanning.
- False Positive Auditing - Records each detection verdict as a true or false positive entry for downstream remediation tracking.
- Application Security - Detects and prevents secrets from being committed to code.
- Code Security - Prevents accidental commits of sensitive credentials and secrets.
- Identity and Access Management - Detects and prevents secrets from being committed to code.
- Identity and Privacy - CLI for auditing and preventing secrets in source code.
- Secret Detection - Detects and prevents secrets from entering the codebase.
- Secret Scanning - Prevents secrets from being committed by scanning diffs against regex patterns.
- Secrets Scanning - Identifies potential secrets within a codebase using modular detection logic.
- Security and Vulnerability Scanning - Prevents secrets from being committed to version control.
