secrets-detection

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

🔓 🔓 Find secrets and passwords in container images and file systems 🔓 🔓

Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data and Git history.

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

Find leaked secrets everywhere.

Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.

Entropy is a CLI tool that will scan your codebase for high entropy lines, which are often secrets.

High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.

Scan your code for security misconfiguration, search for passwords and secrets. 🔍

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive data, such as API endpoints and potential security vulnerabilities, making it an essential resource for and bug bounty hunters and security researchers.

Searches through git repositories for high entropy strings and secrets, digging deep into commit history

Identify hardcoded secrets in static structured text

GitGuardian Shield GitHub Action - Find exposed credentials in your commits

The missing middleware for your configuration and secrets.

LLM privacy gateway in Go — millisecond-latency PII and secret redaction. Used in production by PackyCode.

Benchmarking repo for secrets scanning

SecretOpt1c is a Red Team tool that helps uncover sensitive information in websites using ACTIVE and PASSIVE Techniques for Superior Accuracy!

Secret and/or credential patterns used for gf.

Monitors Github for leaked secrets