Git Secret Scanner

What Git Secret Scanner is

Git Secret Scanner is a free tool for finding hardcoded credentials in GitHub organizations and local filesystems. It combines pattern matching with Shannon entropy analysis, context scoring, and denylist filtering to reduce false positives. Listed patterns include AWS, GCP, Azure, GitHub, Slack, Stripe, JWT, SSH and PEM keys, and database URIs. Findings can be exported as JSON, CSV, or SARIF; the README describes SARIF compatibility with GitHub Advanced Security, Azure DevOps, GitLab Security Dashboard, and SonarQube. GitHub Actions and GitLab CI examples are provided, along with guidance for uploading SARIF to GitHub Advanced Security. Findings may include severity, immediate actions, prevention steps, provider-specific rotation commands, and documentation links. The scanner does not authenticate with or test detected credentials, so matches need manual verification. Findings are masked in logs, and reports containing finding details should be encrypted. Installation requires Python 3.8+ and Git 2.20+; organization scans also need a GitHub token and organization name. Documented defaults include a 10 MB maximum file size, local scan depth of 10, and concurrency of 5 repositories and 50 files. The tool is MIT licensed for personal or commercial use.

Who it suits

It suits security, DevOps/SRE, development, and compliance teams looking for credential scans in GitHub organizations or local filesystems. Teams should be prepared to verify matches manually and protect reports containing finding details.

Limits

The documented defaults limit files to 10 MB, local scan depth to 10, and concurrency to five repositories and 50 files. Findings are not validated through authentication and require manual verification.

Getting started

1. Open the GitHub repository.
2. Install Python 3.8+ and Git 2.20+.
3. For an organization scan, provide a GitHub token and organization name.
4. Use a local filesystem scan, or connect a scan through the documented GitHub Actions or GitLab CI examples.
5. Export findings as JSON, CSV, or SARIF for review.

Verdict

Git Secret Scanner combines broad credential patterns with multiple output formats and CI examples. Its findings are leads rather than verified credentials, and reports with details need encryption.