I built a security scanner for my pastebin. But detecting secrets is harder than I expected.

I have been working on PasteDB, a paste-sharing application where people can store and share code, text, logs, and other content.

While building it, I started thinking about a problem:

What if someone accidentally pastes an API key, database password, or access token and makes it public?

Deleting the paste later might not be enough. Someone could already have copied the credential.

So I decided to build a security scanner that runs directly in the browser before a paste is created.

The idea was simple:

• Identify known credentials using provider-specific patterns.
• Detect unusual random strings that might be secrets.
• Check surrounding context to understand whether a string is likely to be sensitive.
• Warn users before they publish potentially exposed credentials.

But the implementation wasn’t as simple as I expected.

A string that looks random isn’t necessarily a secret. A UUID might look suspicious, while a real API key might not match the pattern I expected.

I had to think about false positives, missed detections, incomplete credentials, and how to avoid exposing the detected values in the warning UI.

One important design decision was to keep the scanning local in the browser. The paste content and scanner findings don’t need to be sent to an external service just to detect potential secrets.

The scanner is now working, and I’m continuing to improve it.

What I’m curious about:

How do you approach secret detection in developer tools?

Do you prefer pattern-based detection, entropy-based detection, or a combination of both?

And how do you balance catching real secrets without constantly warning users about harmless strings?

I’d genuinely like to hear how other developers approach this problem.