← All repos

detect-secrets

An enterprise friendly way of detecting and preventing secrets in code.

GitHub
Browse cluster: HTML Parsing & Error Tracking →
1,450commits
93contributors
4languages

Tech stack & purpose

detect-secrets is a Python-based tool developed by Yelp that detects and prevents secrets from entering code repositories. Unlike other secret-detection packages that only identify secrets, detect-secrets is designed for enterprise use and provides a systematic approach to preventing new secrets from being committed while maintaining a baseline of existing ones. The tool uses periodic scanning of git diffs against heuristically crafted regex statements to identify newly committed secrets, and includes three main command-line utilities: detect-secrets scan (for creating and updating baselines), detect-secrets-hook (for blocking new secrets), and detect-secrets audit (for analyzing and labeling detected secrets). It supports multiple detection strategies including regex-based rules, entropy detection, and keyword detection, with various plugins for common secret types like AWS keys, GitHub tokens, and private keys, along with configurable filters to reduce false positives.

Community & reference links

Languages

Python
99.4%
Shell
0.5%
Makefile
0.1%
PHP
0.0%

Contributors (top 30 of 93)