---
id: detect-secrets
version: "1.5.0"
license: unclear
license_treatment: permissive
maintenance: active
---

# detect-secrets — Tool for detecting secrets in the codebase

License: permissive · Maintenance: active · Downloads: 7.4M/mo

## What it is and what it does

detect-secrets is a command-line tool and Python library for finding hardcoded secrets in code repositories. It uses heuristic regex patterns and entropy analysis to identify API keys, tokens, credentials, and other sensitive data that should not be committed. Unlike simple grep-based tools, it's designed for enterprise use by establishing a baseline of existing secrets and then preventing new ones from entering the codebase—avoiding the need to remediate all historical secrets at once.

The package works by scanning git diffs rather than entire history, reducing overhead. It provides three main workflows: creating and updating a baseline of known secrets, running as a pre-commit hook to alert on new secrets, and auditing baselines to label false positives. It includes detectors for common secret types (AWS keys, GitHub tokens, Slack tokens, private keys, etc.) and supports custom plugins and filters for specialized detection rules.

Use it for:

- Set up pre-commit hooks to prevent developers from accidentally committing API keys or database credentials to git
- Create a baseline of existing secrets in a large legacy codebase, then enforce that no new secrets are added
- Audit and label false positives in a baseline to improve detection accuracy for your specific codebase patterns
- Integrate into CI/CD pipelines to scan staged files and fail builds if new secrets are detected
- Use custom detector plugins to find organization-specific secret patterns (internal tokens, proprietary key formats)

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Detects secrets (API keys, tokens, credentials) in code repositories by scanning diffs against heuristic patterns, and maintains a baseline to prevent new secrets from being committed.

Yes. This is a mature, actively maintained tool with low install friction and no known vulnerabilities. It solves a real security problem (preventing credential leaks) with an enterprise-friendly approach that doesn't require fixing all historical secrets immediately. The permissive license and broad plugin ecosystem make it suitable for most projects.

## Install

pip install detect-secrets
uv add detect-secrets
poetry add detect-secrets

## Installing detect-secrets

Before you install: Low install friction with only two runtime dependencies (pyyaml, requests). Active maintenance with recent commits and 4620 repository stars indicate solid community adoption and ongoing support.

License in practice: Permissive license allows use in commercial and private projects without significant restrictions.

Quickstart:

pip install detect-secrets

# Create baseline of current secrets
detect-secrets scan > .secrets.baseline

# Or use in Python:
from detect_secrets import SecretsCollection
from detect_secrets.settings import default_settings

secrets = SecretsCollection()
with default_settings():
    secrets.scan_file('config.ini')

Verify before relying:

- Whether all secret types (API keys, tokens, credentials) are detected with acceptable false-positive rates across different formats
- Performance characteristics when scanning large repositories or many files in a single pass

## Package facts

- License: not declared (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 7.4M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

detect secrets in code, credential scanning, API key detection, pre-commit secret detection, baseline secret management, entropy-based secret finder, git hook secret blocker, secret-detection, pre-commit-hook, credential-scanning

[View on SkillFed](https://skillfed.io/packages/detect-secrets) · [View on PyPI](https://pypi.org/project/detect-secrets/)