Source Code Secret Scanner

Keys almost always leak the same way: someone pastes a block of config into an example file, forgets the database line and pushes. Pasting that same block here points at the problem in seconds. The scanner marks the line, names the credential type and shows only a fragment of the value, with the middle replaced by asterisks, so the review itself does not become a second leak.

Each line goes through two passes. The first matches known shapes: AKIA followed by sixteen capitals is an AWS key id, ghp_ plus thirty six characters is a GitHub token, sk_live_ is a Stripe production key, and three dot separated blocks starting with eyJ form a JSON Web Token. The second pass measures the Shannon entropy of every token twenty characters or longer.

That entropy figure is what separates noise from credentials. A random 32 character password sits near 5 bits per character, while the word configuration stays below 3.3. The 3.5 default catches hashes and keys without flagging every long variable name. Drop the threshold to 3.2 for an aggressive sweep before making a repository public, and raise it to 4.2 when false positives bury the real findings.