{"categories":[{"label":"Software Development","url":"https://skillfed.io/packages/category/software-development/3"},{"label":"Utilities","url":"https://skillfed.io/packages/category/utilities/2"}],"enrichment":{"capability":"Detects secrets (API keys, tokens, credentials) in code repositories by scanning diffs and files against heuristic patterns, with support for baseline management to prevent new secrets from entering the codebase.","skillfed_tags":["secret-detection","pre-commit","credential-scanning"],"use_cases":["Prevent accidental commits of API keys and database credentials in development workflows via pre-commit hooks","Create and maintain a baseline of known secrets in legacy codebases while blocking new ones from entering","Audit existing repositories to identify and catalog secrets for rotation and migration to secure vaults","Integrate secret detection into CI/CD pipelines to catch credentials before they reach shared branches","Customize detection rules for organization-specific secret patterns and reduce false positives through filtering"],"what_it_does":"bc-detect-secrets is a secret-detection tool designed for enterprise use, scanning codebases to find hardcoded credentials, API keys, and tokens. Unlike simple pattern matchers, it uses a baseline approach: you create a snapshot of secrets currently in your repository, then the tool prevents new secrets from being committed without explicitly bypassing the check. It runs on git diffs rather than full repository scans, reducing overhead.\n\nThe package includes multiple detection plugins and integrates with git hooks and pre-commit workflows. It's maintained by Bridgecrew as a fork of the original Yelp detect-secrets project and depends on pyyaml, requests, and unidiff for configuration, HTTP operations, and diff parsing.","worth_installing":"Yes. Active maintenance, no known vulnerabilities, low install friction, and permissive licensing make it a practical choice for teams needing to prevent secret leaks. The baseline-first approach is well-suited to large legacy codebases where immediate remediation is infeasible. Install if you need systematic secret detection in git workflows; skip if your codebase is already fully credential-free and you only need occasional ad-hoc scanning."},"id":"bc-detect-secrets","links":{"html":"https://skillfed.io/packages/bc-detect-secrets","md":"https://skillfed.io/packages/bc-detect-secrets.md","pypi":"https://pypi.org/project/bc-detect-secrets/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-08-13","license_spdx":null,"license_treatment":"permissive","name":"bc-detect-secrets","python_support":"supports_current","summary":"Tool for detecting secrets in the codebase"},"popularity":{"monthly_downloads":5525004,"position":2080,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"1.5.49"}