repo-secret-scanner

What it does

• Nine rules for the shapes that actually leak: AWS access keys, GitHub, Slack and Google tokens, Stripe live keys, OpenAI-style keys, PEM private-key blocks, JWTs, and bare api_key or password assignments.
• Findings are always redacted to first and last four characters plus a length - a report that prints the secret in a CI log has moved the leak rather than stopped it.
• --selftest plants a dummy secret and confirms it is caught, so a broken scanner cannot sit there quietly reporting clean.
• --entropy is opt-in, because flagging every long string is how a gate gets switched off.

How it is proved

One file, 167 lines, no dependencies; selftest passes on a planted secret. It is the gate I run over my own repositories before every push.

Pythonstandard library only9 rulesexit 1 for CI

People find this looking for

pre-commit secret scanner no dependencies, find api keys before commit, python leaked token scanner CI, aws key committed by accident, redacted secret report.

If that is your week and you would rather someone else did it, write to hello@dkautomation.dev or open an issue.