Manavarya09

Secretscan — Productivity skill for Claude Code

Productivity community

Real-time secret & credential detector for Claude Code — 47 patterns, PostToolUse hook, lossless recovery.

How to install Secretscan

This entry records only its repository, not the path inside it, so there is no exact command to give. Open Manavarya09/secretscan and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Secretscan does

Real-time secret & credential detector for Claude Code — 47 patterns, PostToolUse hook, lossless recovery.

Alternatives in Productivity

Linear - Ticket Management — You are tasked with managing Linear tickets, including creating tickets from thoughts documents, updating exis 10k ★
Tradingview MCP — Real-time crypto & stock screening, advanced technical indicators, Bollinger Bands intelligence, candlestick p 2.6k ★
GrokSearch — Integrate Grok's powerful real-time search capabilities into Claude via the MCP protocol 1.8k ★

README

SecretScan

**Real-time secret & credential detector for Claude Code.** Blocks API keys, tokens, private keys, and database passwords from ever entering your LLM context window.

[![Rust](https://img.shields.io/badge/Rust-1.70+-orange.svg)](https://www.rust-lang.org/) [![npm](https://img.shields.io/npm/v/@masyv/secretscan)](https://www.npmjs.com/package/@masyv/secretscan) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)

The Problem

When Claude Code runs tools, their outputs flow directly into the context window. That includes:

cat .env → your API keys
git log → commit messages with accidentally committed credentials
Database query results → connection strings, hashed passwords
curl responses → tokens, JWTs, session cookies

**SecretScan intercepts every tool output** before it reaches Claude, redacts detected secrets, and logs them locally. Claude sees `[REDACTED:anthropic_api_key:bbfc6912]` — not `sk-ant-api03-...`.

47 Built-in Patterns

Severity	Providers
🔴 Critical	Anthropic, OpenAI, AWS, GitHub, Stripe, Google Service Account, PostgreSQL, MySQL, MongoDB, PEM Private Keys
🟠 High	GitLab, Slack, npm, SendGrid, Cloudflare, Azure, Redis, Heroku, Vercel, Datadog, HuggingFace, Discord, Shopify
🟡 Medium	JWT tokens, Twilio, env file secrets, Slack webhooks
🔵 Low	Test keys, certificates, high-entropy strings

Plus **Shannon entropy analysis** for detecting unknown secrets by statistical pattern.

Quick Start

# Install from source
git clone https://github.com/Manavarya09/secretscan
cd secretscan
./scripts/build.sh && ./scripts/install.sh

# Auto-configure Claude Code
secretscan setup

# That's it — restart Claude Code and you're protected.

What It Looks Like

$ echo 'ANTHROPIC_API_KEY=sk-ant-api03-...' | secretscan scan

🚨  1 secret found:

  🔴 [CRITICAL]  Anthropic API Key   fingerprint: bbfc6912
             sk-ant-api03-xxxxx…
``