{"categories":[{"label":"Software Development","url":"https://skillfed.io/packages/category/software-development/2"},{"label":"Utilities","url":"https://skillfed.io/packages/category/utilities/2"}],"enrichment":{"capability":"Detects secrets (API keys, tokens, credentials) in code repositories by scanning diffs against heuristic patterns, and maintains a baseline to prevent new secrets from being committed.","skillfed_tags":["secret-detection","pre-commit-hook","credential-scanning"],"use_cases":["Set up pre-commit hooks to prevent developers from accidentally committing API keys or database credentials to git","Create a baseline of existing secrets in a large legacy codebase, then enforce that no new secrets are added","Audit and label false positives in a baseline to improve detection accuracy for your specific codebase patterns","Integrate into CI/CD pipelines to scan staged files and fail builds if new secrets are detected","Use custom detector plugins to find organization-specific secret patterns (internal tokens, proprietary key formats)"],"what_it_does":"detect-secrets is a command-line tool and Python library for finding hardcoded secrets in code repositories. It uses heuristic regex patterns and entropy analysis to identify API keys, tokens, credentials, and other sensitive data that should not be committed. Unlike simple grep-based tools, it's designed for enterprise use by establishing a baseline of existing secrets and then preventing new ones from entering the codebase\u2014avoiding the need to remediate all historical secrets at once.\n\nThe package works by scanning git diffs rather than entire history, reducing overhead. It provides three main workflows: creating and updating a baseline of known secrets, running as a pre-commit hook to alert on new secrets, and auditing baselines to label false positives. It includes detectors for common secret types (AWS keys, GitHub tokens, Slack tokens, private keys, etc.) and supports custom plugins and filters for specialized detection rules.","worth_installing":"Yes. This is a mature, actively maintained tool with low install friction and no known vulnerabilities. It solves a real security problem (preventing credential leaks) with an enterprise-friendly approach that doesn't require fixing all historical secrets immediately. The permissive license and broad plugin ecosystem make it suitable for most projects."},"id":"detect-secrets","links":{"html":"https://skillfed.io/packages/detect-secrets","md":"https://skillfed.io/packages/detect-secrets.md","pypi":"https://pypi.org/project/detect-secrets/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2024-05-06","license_spdx":null,"license_treatment":"permissive","name":"detect-secrets","python_support":"unspecified","summary":"Tool for detecting secrets in the codebase"},"popularity":{"monthly_downloads":7376210,"position":1748,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"1.5.0"}