scan4secrets

What scan4secrets is

scan4secrets is a command-line security scanner for source trees, running web apps, and CI logs. It checks for leaked credentials, code vulnerabilities, and misconfigurations, with 416 rules: 193 for secrets and 223 for vulnerabilities or misconfiguration. Its SAST engine covers issues such as injection, SSRF, XSS, weak cryptography, JWT flaws, and infrastructure configuration problems. For web scans, its crawler parses JavaScript source maps to extract endpoints and scans response headers. Authenticated DAST supports cookies, headers, and Burp or ZAP proxies. An optional verification mode probes vendor APIs to see whether detected tokens are live. Findings can be exported as SARIF, JSON, JSONL, CSV, HTML, Excel, or PDF. Users can add secret and vulnerability rules by editing YAML files, without changing code. The maker documents integration examples for pre-commit, GitHub Actions, GitLab CI, Jenkins, and Docker in CI. It supports GitHub, GitLab, and Bitbucket, and runs on Linux and Windows. The project is MIT licensed, with source, pipx, and Docker installation routes. Its architecture page sets a default maximum file size of 10 MB and maximum line length of 4096 characters.

Who it suits

It suits development and security teams that want to scan source code, CI logs, and live staging or production systems. The maker describes it as a complement to gitleaks for teams scanning live systems alongside source code.

Limits

The architecture page gives a default maximum file size of 10 MB and a maximum line length of 4096 characters. Secret values appear in full by default; the maker recommends using --mask before uploading reports to shared artifact stores.

Getting started

1. Open the scan4secrets website.
2. Choose the MIT-licensed open-source CLI plan, listed as free.
3. Install from source, with pipx, or through Docker.
4. Run it on Linux or Windows against source trees, running web apps, or CI logs.
5. Add it to a documented pre-commit, GitHub Actions, GitLab CI, Jenkins, or Docker in CI workflow.

Verdict

Choose scan4secrets if you need a free, MIT-licensed CLI that scans source, CI logs, and live web apps, with customizable rules and several report formats. It is a less direct fit if you need files above its default size or line-length limits; use --mask before sharing reports because secret values are shown in full by default.