secret-scan-lite

Fast local secret scanner for developers before they push code.

secret-scan-lite is a tiny zero-dependency CLI that scans your project for leaked tokens, private keys, suspicious .env values, and high-entropy strings. It is designed for quick local checks, CI gates, and lightweight open-source projects that want a simple safety net.

Why people use it

• One command before pushing code.
• No cloud upload — everything runs locally.
• Useful output for humans and CI: text, JSON, Markdown, and SARIF.
• Baselines for old accepted findings while still blocking new leaks.
• Zero runtime dependencies and works with Node.js 18+.

Install

npm install -g secret-scan-lite

Or run without installing:

npx secret-scan-lite

Usage

secret-scan-lite
secret-scan-lite --dir ./my-project
secret-scan-lite --format markdown --output secret-report.md
secret-scan-lite --format sarif --output results.sarif --fail-on medium

Example output

⚠️  Found 2 potential secrets:
- [high] src/config.js:4:16 GitHub token (ghp_…1234) #a1b2c3d4e5f6a7b8
- [medium] .env:2:1 Sensitive assignment (supe…2345) #b2c3d4e5f6a7b8c9

CI example

name: Secret Scan
on: [push, pull_request]
jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npx secret-scan-lite --fail-on high

Baseline workflow

Create a baseline from existing findings:

secret-scan-lite --format json --output secret-baseline.json --fail-on never

Then ignore those fingerprints later:

secret-scan-lite --baseline secret-baseline.json

Detection rules

• AWS access keys
• GitHub tokens
• Slack tokens
• Private key blocks
• JWT-like tokens
• Generic api_key, secret, token, password, and client_secret assignments
• High-entropy tokens

Exit codes

• 0: scan completed and no finding reached --fail-on
• 1: findings reached --fail-on
• 2: invalid input or runtime error

Limitations

This tool is intentionally lightweight. It is a developer guardrail, not a replacement for a full enterprise secret-management program. Always rotate exposed credentials immediately.

License

MIT