bc-detect-secrets

What it is and what it does

bc-detect-secrets is a secret-detection tool designed for enterprise use, scanning codebases to find hardcoded credentials, API keys, and tokens. Unlike simple pattern matchers, it uses a baseline approach: you create a snapshot of secrets currently in your repository, then the tool prevents new secrets from being committed without explicitly bypassing the check. It runs on git diffs rather than full repository scans, reducing overhead.

The package includes multiple detection plugins and integrates with git hooks and pre-commit workflows. It's maintained by Bridgecrew as a fork of the original Yelp detect-secrets project and depends on pyyaml, requests, and unidiff for configuration, HTTP operations, and diff parsing.

Use it for:

• Prevent accidental commits of API keys and database credentials in development workflows via pre-commit hooks
• Create and maintain a baseline of known secrets in legacy codebases while blocking new ones from entering
• Audit existing repositories to identify and catalog secrets for rotation and migration to secure vaults
• Integrate secret detection into CI/CD pipelines to catch credentials before they reach shared branches
• Customize detection rules for organization-specific secret patterns and reduce false positives through filtering

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Detects secrets (API keys, tokens, credentials) in code repositories by scanning diffs and files against heuristic patterns, with support for baseline management to prevent new secrets from entering the codebase.

Yes. Active maintenance, no known vulnerabilities, low install friction, and permissive licensing make it a practical choice for teams needing to prevent secret leaks. The baseline-first approach is well-suited to large legacy codebases where immediate remediation is infeasible. Install if you need systematic secret detection in git workflows; skip if your codebase is already fully credential-free and you only need occasional ad-hoc scanning.

Install

bc-detect-secrets on PyPI

pip install bc-detect-secrets

uv add bc-detect-secrets

poetry add bc-detect-secrets

Installing bc-detect-secrets

Before you install

Low install friction with three lightweight runtime dependencies (pyyaml, requests, unidiff). Active maintenance as of 2026-08-13 with recent release. Supports Python 3.8 through 3.13.

License in practice

Apache License 2.0 (permissive) allows use in commercial and private projects with minimal restrictions; you must include a copy of the license and note material changes.

Quickstart

pip install bc-detect-secrets

# Create baseline of current secrets
detect-secrets scan > .secrets.baseline

# Use in git hook to block new secrets
git diff --staged --name-only -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline

Requires git repository context for diff-based scanning; full-file scanning available with --all-files flag but intended for initial baseline creation.

Verify before relying

• Accuracy of the heuristic regex patterns and entropy checks against real-world secret types
• Performance impact when scanning large repositories or high-frequency pre-commit usage
• Customization depth available for organization-specific secret patterns beyond built-in plugins

Package facts

Evidence: bc_detect_secrets-1.5.49-py3-none-any.whl

Keywords: secret-management, pre-commit, security, entropy-checks

Tags

More Software Development packages

Further reading