I almost leaked my Discord bot's token last month. Here's the tool I built so it never happens again.

So a few weeks back I was working late on a Discord bot project (Node.js, discord.js v14, the usual stack), moving fast, committing every few minutes because that's just how I work when I'm in the zone. At some point I typed git add . without thinking twice, committed, and pushed.

Ten minutes later I'm staring at my .env file sitting right there in the GitHub diff. Bot token, MongoDB connection string, all of it, in plain text, in a public repo.

I got lucky. Caught it fast, rotated the token immediately, force-pushed to scrub the history, and spent the next hour paranoid that some bot scraping GitHub for exposed tokens had already grabbed it. Nothing bad happened in the end, but it rattled me enough that I actually looked into how often this happens to other people.

Turns out: constantly. There are entire automated systems that do nothing but scan public GitHub commits for leaked AWS keys, Stripe secrets, Discord tokens, you name it. It's basically a race between "did you push a secret" and "did a bot find it first."

okay but don't tools already exist for this?

Yeah, and I looked at a bunch of them. gitleaks, truffleHog, git-secrets, GitGuardian's ggshield. They're all solid, some of them way more mature than anything I could build solo. But two things kept bugging me:

1. Most of them are CLI-only. You get a wall of red text in your terminal and that's it. No way to see patterns over time, no "oh wait, I keep leaking secrets in this one folder" kind of insight.
2. The ones that DO have a dashboard (like GitGuardian) require an account and send stuff to their servers. Which, fair enough, that's their business model, but for a solo dev or small team that just wants a local safety net, it felt like overkill.

So I built my own. Called it GitShield.

what it actually does

Pretty simple concept:

• Installs a pre-commit git hook with one command (gitshield init)
• Every time you commit, it scans your staged files for stuff that looks like a secret
• If it finds something, it blocks the commit and tells you exactly what file, what line, and what kind of secret it thinks it found
• Everything happens locally. No account, no API calls to some external service, nothing leaves your machine

$ git commit -m "quick fix"

 GitShield

✖ 1 potential secret(s) found

  [CRITICAL] .env:1  Discord Bot Token
  preview: MTIz********************67

GitShield blocked this commit. Fix the issues above, or bypass with:
  git commit --no-verify

It catches the usual suspects out of the box: AWS keys, Discord tokens and webhooks, Slack tokens, Stripe keys, private key blocks, DB connection strings with credentials baked in. But I also didn't want it to only catch things I already knew the pattern for, so I added entropy-based detection too. Basically it flags any suspiciously random-looking string even if it doesn't match a known format. Company-internal tokens, custom API keys, whatever weird format your infra uses, it'll still catch high entropy strings that look like they could be secrets.

the dashboard thing

This was the part I actually cared most about. Run gitshield dashboard and it spins up a tiny local server showing your scan history. How many times you've been caught, what got flagged, when. Nothing fancy, no charts library, just a clean dark-themed page reading from a local JSON file.

Felt like the missing piece. Every other tool treats each scan as a one-off event. I wanted to actually see the pattern.

it's also configurable if the defaults annoy you

Drop a .gitshield.yml in your repo root and you can:

entropy:
  enabled: true
  threshold: 4.0

customPatterns:
  - name: "Internal Company Token"
    regex: "INTL_[A-Za-z0-9]{20,}"
    severity: high

severityThreshold: low

Add your own regex patterns, tune the entropy threshold if it's giving you false positives, or set a severity threshold so only critical stuff actually blocks your commit.

There's also a GitHub Action template included, because let's be honest, someone's going to git commit --no-verify eventually and you want a backup catching it at the CI level too.

what's still rough

Being upfront here because I think that matters more than pretending it's finished:

• Not on npm yet, so right now it's a clone + npm link situation
• The entropy detector can definitely throw false positives on long random-looking strings that aren't actually secrets (base64-encoded images in code, hashes, that kind of thing)
• There's a VS Code extension prototype in the repo that shows inline warnings as you type, but I haven't published it, it needs more testing first

I'd genuinely rather ship something honest about its rough edges than oversell it and have people find out the hard way.

try it

Repo's here: https://github.com/fay-saal/gitshield

git clone <repo-url>
cd gitshield
npm install
npm link
gitshield init

If you've ever had that stomach-drop moment of seeing a secret in a git diff after you already pushed, I'd love to know if this actually helps or if I'm missing something obvious. Issues and PRs are open, and if you find a pattern it should catch but doesn't, tell me, that's the fastest way to make this better.