Secret Scanner: Detect API Keys, Tokens, and Credentials in Code
Secrets — API keys, tokens, private keys, and database passwords — end up in code more often than developers realize. They get hardcoded during local development, committed accidentally, or left in config files checked into version control. Once in git history, a secret is permanently exposed unless you rotate it and rewrite history. This tool scans code and config text for 30+ secret patterns using regex and entropy analysis, entirely in your browser — nothing leaves your device.
All scanning runs in your browser — no code is ever sent to a server. Entropy analysis also flags high-randomness strings that may be undeclared secrets.
Why Secrets End Up in Code
The most common causes: hardcoded during development (easier than setting up env vars early), forgotten in commit history after being 'deleted' from the file (git history is permanent), CI/CD config exposure (environment variables logged in plaintext), and copied from documentation (example keys that were never rotated). Even a private repository is not safe — access leaks, insider threats, and future open-sourcing all create risk.
What Types of Secrets Are Detected
The scanner matches patterns for: cloud provider keys (AWS AKIA*, GCP service accounts), source code platform tokens (GitHub ghp_*, GitLab glpat-*), payment processor keys (Stripe sk_live_*, pk_live_*), communication APIs (Twilio, SendGrid, Mailgun), generic API key patterns (api_key=, apiKey:, token=), private keys (-----BEGIN RSA PRIVATE KEY-----), and JWT tokens (eyJ* base64 header pattern).
How to Properly Manage Secrets
Never commit secrets. Store them as environment variables loaded at runtime (dotenv locally, CI/CD secrets manager in pipelines). For production, use a dedicated secret manager: AWS Secrets Manager, HashiCorp Vault, or GCP Secret Manager provides versioning, rotation, and audit logs. Add a .gitignore rule for .env files and use git-secrets or pre-commit hooks to block accidental commits.
Common Secret Patterns Detected
- AWS: AKIA[0-9A-Z]{16} (access key ID)
- GitHub: ghp_[A-Za-z0-9]{36} (personal access token)
- Stripe: sk_live_ or pk_live_ prefix
- Twilio: SK[a-z0-9]{32} (API key SID)
- Google: AIza[0-9A-Za-z-_]{35} (API key)
- Generic JWT: eyJ[A-Za-z0-9]+ (base64-encoded header)
- RSA Private Key: -----BEGIN RSA PRIVATE KEY----- block
Secrets Management Best Practices
- Use .env files locally, never commit them (.gitignore)
- Use environment variables in CI/CD — never hardcode in scripts
- Rotate any key that may have been exposed, even briefly
- Use a secret manager (Vault, AWS SM) for production secrets
- Enable git-secrets or Gitleaks as a pre-commit hook
Frequently Asked Questions
What is a secret in software development?
A secret is any credential that grants access to a system or service: API keys, OAuth tokens, private SSH/TLS keys, database passwords, JWT signing keys, and cloud provider access keys. Exposing a secret allows anyone who finds it to impersonate your application or access your infrastructure.
How do secrets end up in code repositories?
The most common causes: hardcoded during development for convenience, forgotten in commit history after being 'deleted' (git history is permanent), accidentally committed in .env files, logged in CI/CD output, or left in example code copied from documentation that was never rotated.
Can I remove a secret from git history after committing it?
Yes, but it requires rewriting git history with tools like git filter-repo or BFG Repo Cleaner, then force-pushing to all remotes. This doesn't remove the secret from any forks or clones already made. Always rotate the key first — treat history cleanup as secondary.
What is git-secrets?
git-secrets is an open-source tool by AWS that prevents you from committing secrets by scanning staged files before each commit (via a pre-commit hook). It uses configurable regex patterns to detect AWS keys, passwords, and custom secrets you define. Similar tools include Gitleaks and TruffleHog.
What are the best practices for managing API keys?
Never hardcode keys in source files. Store them as environment variables. Use a .env file locally (add to .gitignore). In CI/CD pipelines, use the platform's secrets store (GitHub Actions secrets, GitLab CI variables). In production, use a secret manager like AWS Secrets Manager, HashiCorp Vault, or GCP Secret Manager.
What is a secret manager?
A secret manager is a service that stores, versions, and controls access to secrets. It provides audit logs (who accessed which secret when), automatic rotation, fine-grained IAM policies, and encrypted storage. Examples: AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager, Azure Key Vault.
Does this tool send my code anywhere?
No. All scanning runs entirely in your browser using JavaScript regex patterns. Your code never leaves your device and is never transmitted to any server. This is the same approach used by local tools like Gitleaks — the scanning logic runs client-side.