SecretSecurity

A .NET CLI tool that scans staged git changes for secrets, API keys, tokens, and sensitive credentials — and blocks commits when critical findings are detected.

What it detects

Type	Examples	Severity
Provider tokens	AWS access keys (AKIA…), Stripe live keys (sk_live_…), GitHub PATs (ghp_…), Slack tokens	Critical
Private keys	RSA, EC, OpenSSH private key blocks	Critical
Azure connection strings	DefaultEndpointsProtocol, AccountKey	Critical
Explicit secret assignments	api_key=, token=, secret: with a value	High
Database connection strings	General ADO.NET, Postgres/MySQL/MongoDB/Redis URLs	High
Suspicious blobs	High-entropy strings in suspicious context	Warning

Dev-safe connections (localhost, 127.0.0.1, integrated security) are automatically ignored.

Installation

Requires .NET 10 SDK or later.

dotnet tool install --global SecretSecurity

Usage

Install the pre-commit hook

Run once inside your repository:

secretsecurity install

This writes a pre-commit hook to .git/hooks/ that runs secretsecurity scan automatically on every commit.

Uninstall the pre-commit hook

secretsecurity uninstall

Removes the hook if it was installed by SecretSecurity. If the hook was created by something else, it is left untouched.

Update

secretsecurity update

Updates the tool to the latest version via dotnet tool update --global.

Scan manually

secretsecurity scan

Scans all currently staged changes (git diff --cached). Exits with code 1 if any High or Critical findings are found, blocking the commit.

Ignore files

Create a .secretsecurityignore file in your repo root with one pattern per line:

tests/fixtures/
mock_secrets.json

Any staged file whose path contains a listed pattern is skipped.

How it works

1. Runs git diff --cached -U0 to get only the lines you are about to commit.
2. Each added line is checked against a set of compiled regex patterns ordered by confidence.
3. Matched values are partially masked in the output (e.g. ghp_****Ab).
4. If any finding is High or Critical, the scan exits with code 1, preventing the commit.

Building from source

git clone https://github.com/omegaleo/SecretSecurity.git
cd SecretSecurity
dotnet build
dotnet run --project SecretSecurity -- scan

Contributing

Contributions are welcome! To get started:

1. Fork the repository and create a branch from main.
2. Make your changes and ensure the project builds (dotnet build).
3. Open a pull request describing what you changed and why.

Please open an issue first for any significant change so we can discuss the approach before you invest time in it.

Support

If SecretSecurity saves you from an accidental secret leak, consider supporting its development:

• GitHub Sponsors — sponsor directly on GitHub
• Ko-fi — buy me a coffee

License

MIT — see LICENSE.md for details.