detect-secrets – detect and prevent secrets in source code

detect-secrets is a command-line toolkit for finding credentials in source code and preventing new secrets from entering a repository.

Its central concept is the baseline: a snapshot of known findings that lets a team acknowledge existing technical debt while still blocking newly introduced secrets. This approach is particularly useful for large codebases where removing every historical credential immediately may be unrealistic. The project separates scanning, commit-time enforcement and human review into distinct workflows, so teams can tune detection without treating every potential match as a confirmed leak.

This is free and open source software.

Key Features

• Generate and update baseline files containing potential secrets discovered across a codebase.
• Use a dedicated hook command to reject newly introduced findings that are not already in the baseline.
• Audit baseline entries interactively to distinguish genuine secrets from false positives.
• Choose from numerous built-in detector plugins covering service credentials, private keys, tokens and high-entropy strings.
• Disable individual plugins or load custom detector plugins for organisation-specific credentials.
• Apply filters to suppress known false-positive patterns and improve the signal-to-noise ratio.
• Verify supported credentials through network checks, or disable verification when offline scanning is preferred.
• Scan Git-tracked files by default or recursively inspect other files when required.
• Use inline allowlist comments when a particular value is intentionally present in source code.
• Exclude matches by line, file or secret pattern and use word lists to filter uninteresting values.
• Produce JSON output from hook and audit workflows for use by other tools and automation.
• Use detect-secrets as a Python library, allowing its scanning engine and configuration system to be embedded in other applications.

Website: github.com/Yelp/detect-secrets
Support:
Developer: Yelp
License: Apache License 2.0

detect-secrets is written in Python. Learn Python with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.