detect-secrets – detect and prevent secrets in source code

detect-secrets is a command-line toolkit for finding credentials in source code and preventing new secrets from entering a repository.

Its central concept is the baseline: a snapshot of known findings that lets a team acknowledge existing technical debt while still blocking newly introduced secrets. This approach is particularly useful for large codebases where removing every historical credential immediately may be unrealistic. The project separates scanning, commit-time enforcement and human review into distinct workflows, so teams can tune detection without treating every potential match as a confirmed leak.

This is free and open source software.

Key Features

• Generate and update baseline files containing potential secrets discovered across a codebase.
• Use a dedicated hook command to reject newly introduced findings that are not already in the baseline.
• Audit baseline entries interactively to distinguish genuine secrets from false positives.
• Choose from numerous built-in detector plugins covering service credentials, private keys, tokens and high-entropy strings.
• Disable individual plugins or load custom detector plugins for organisation-specific credentials.
• Apply filters to suppress known false-positive patterns and improve the signal-to-noise ratio.
• Verify supported credentials through network checks, or disable verification when offline scanning is preferred.
• Scan Git-tracked files by default or recursively inspect other files when required.
• Use inline allowlist comments when a particular value is intentionally present in source code.
• Exclude matches by line, file or secret pattern and use word lists to filter uninteresting values.
• Produce JSON output from hook and audit workflows for use by other tools and automation.
• Use detect-secrets as a Python library, allowing its scanning engine and configuration system to be embedded in other applications.

Website: github.com/Yelp/detect-secrets
Support:
Developer: Yelp
License: Apache License 2.0

detect-secrets is written in Python. Learn Python with our recommended free books and free tutorials.

Related Software

Read our verdict in the software roundup.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.