Stop Leaking Secrets: A Dependency-Free Python CLI to Catch API Keys Before You Commit

The Problem

Every week, thousands of API keys, AWS credentials, and private keys get committed to git repos and leaked publicly. Most scanners are SaaS-only, require signup, or drag in huge dependency trees.

The Fix: secret_scanner

A single-file, dependency-free Python CLI that scans your codebase for leaked secrets before they hit git history or production.

Detects:

• AWS access keys & secret keys
• GitHub tokens (classic + fine-grained)
• JWTs
• Private key blocks (RSA/PEM)
• Generic high-entropy strings (catches custom API keys)

Why it's different:

• No install beyond optional deps - drop the .py file in and run
• Works in CI (GitHub Actions) or as a pre-commit hook
• No signup, no SaaS lock-in, no telemetry

Try it

$29 one-time, instant delivery via Stripe:
https://buy.stripe.com/00w28t6Ut3zUcZr7zRaR20b

Example usage

python scanner.py --path ./my-repo

Happy to answer questions about detection patterns or CI integration in the comments.