detect-secrets

What it is and what it does

detect-secrets is a command-line tool and Python library for finding hardcoded secrets in code repositories. It uses heuristic regex patterns and entropy analysis to identify API keys, tokens, credentials, and other sensitive data that should not be committed. Unlike simple grep-based tools, it's designed for enterprise use by establishing a baseline of existing secrets and then preventing new ones from entering the codebase—avoiding the need to remediate all historical secrets at once.

The package works by scanning git diffs rather than entire history, reducing overhead. It provides three main workflows: creating and updating a baseline of known secrets, running as a pre-commit hook to alert on new secrets, and auditing baselines to label false positives. It includes detectors for common secret types (AWS keys, GitHub tokens, Slack tokens, private keys, etc.) and supports custom plugins and filters for specialized detection rules.

Use it for:

• Set up pre-commit hooks to prevent developers from accidentally committing API keys or database credentials to git
• Create a baseline of existing secrets in a large legacy codebase, then enforce that no new secrets are added
• Audit and label false positives in a baseline to improve detection accuracy for your specific codebase patterns
• Integrate into CI/CD pipelines to scan staged files and fail builds if new secrets are detected
• Use custom detector plugins to find organization-specific secret patterns (internal tokens, proprietary key formats)

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Detects secrets (API keys, tokens, credentials) in code repositories by scanning diffs against heuristic patterns, and maintains a baseline to prevent new secrets from being committed.

Yes. This is a mature, actively maintained tool with low install friction and no known vulnerabilities. It solves a real security problem (preventing credential leaks) with an enterprise-friendly approach that doesn't require fixing all historical secrets immediately. The permissive license and broad plugin ecosystem make it suitable for most projects.

Install

detect-secrets on PyPI

pip install detect-secrets

uv add detect-secrets

poetry add detect-secrets

Installing detect-secrets

Before you install

Low install friction with only two runtime dependencies (pyyaml, requests). Active maintenance with recent commits and 4620 repository stars indicate solid community adoption and ongoing support.

License in practice

Permissive license allows use in commercial and private projects without significant restrictions.

Quickstart

pip install detect-secrets

# Create baseline of current secrets
detect-secrets scan > .secrets.baseline

# Or use in Python:
from detect_secrets import SecretsCollection
from detect_secrets.settings import default_settings

secrets = SecretsCollection()
with default_settings():
    secrets.scan_file('config.ini')

Verify before relying

• Whether all secret types (API keys, tokens, credentials) are detected with acceptable false-positive rates across different formats
• Performance characteristics when scanning large repositories or many files in a single pass

Package facts

Evidence: detect_secrets-1.5.0-py3-none-any.whl

Keywords: secret-management, pre-commit, security, entropy-checks

Tags

More Software Development packages