---
id: bc-detect-secrets
version: "1.5.49"
license: Apache License 2.0
license_treatment: permissive
maintenance: active
---

# bc-detect-secrets — Tool for detecting secrets in the codebase

License: permissive · Maintenance: active · Downloads: 5.5M/mo

## What it is and what it does

bc-detect-secrets is a secret-detection tool designed for enterprise use, scanning codebases to find hardcoded credentials, API keys, and tokens. Unlike simple pattern matchers, it uses a baseline approach: you create a snapshot of secrets currently in your repository, then the tool prevents new secrets from being committed without explicitly bypassing the check. It runs on git diffs rather than full repository scans, reducing overhead.

The package includes multiple detection plugins and integrates with git hooks and pre-commit workflows. It's maintained by Bridgecrew as a fork of the original Yelp detect-secrets project and depends on pyyaml, requests, and unidiff for configuration, HTTP operations, and diff parsing.

Use it for:

- Prevent accidental commits of API keys and database credentials in development workflows via pre-commit hooks
- Create and maintain a baseline of known secrets in legacy codebases while blocking new ones from entering
- Audit existing repositories to identify and catalog secrets for rotation and migration to secure vaults
- Integrate secret detection into CI/CD pipelines to catch credentials before they reach shared branches
- Customize detection rules for organization-specific secret patterns and reduce false positives through filtering

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Detects secrets (API keys, tokens, credentials) in code repositories by scanning diffs and files against heuristic patterns, with support for baseline management to prevent new secrets from entering the codebase.

Yes. Active maintenance, no known vulnerabilities, low install friction, and permissive licensing make it a practical choice for teams needing to prevent secret leaks. The baseline-first approach is well-suited to large legacy codebases where immediate remediation is infeasible. Install if you need systematic secret detection in git workflows; skip if your codebase is already fully credential-free and you only need occasional ad-hoc scanning.

## Install

pip install bc-detect-secrets
uv add bc-detect-secrets
poetry add bc-detect-secrets

## Installing bc-detect-secrets

Before you install: Low install friction with three lightweight runtime dependencies (pyyaml, requests, unidiff). Active maintenance as of 2026-08-13 with recent release. Supports Python 3.8 through 3.13.

License in practice: Apache License 2.0 (permissive) allows use in commercial and private projects with minimal restrictions; you must include a copy of the license and note material changes.

Quickstart:

pip install bc-detect-secrets

# Create baseline of current secrets
detect-secrets scan > .secrets.baseline

# Use in git hook to block new secrets
git diff --staged --name-only -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline

Requires git repository context for diff-based scanning; full-file scanning available with --all-files flag but intended for initial baseline creation.

Verify before relying:

- Accuracy of the heuristic regex patterns and entropy checks against real-world secret types
- Performance impact when scanning large repositories or high-frequency pre-commit usage
- Customization depth available for organization-specific secret patterns beyond built-in plugins

## Package facts

- License: Apache License 2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 5.5M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

secret detection in code, API key finder, credential scanner, pre-commit secret detection, baseline secret management, entropy-based secret detection, git hook secret prevention, secret-detection, pre-commit, credential-scanning

[View on SkillFed](https://skillfed.io/packages/bc-detect-secrets) · [View on PyPI](https://pypi.org/project/bc-detect-secrets/)