Manavarya09

Secretscan

Name: Secretscan
Author: Manavarya09

Productivity community

SOURCE https://github.com/Manavarya09/secretscan

Description

Real-time secret & credential detector for Claude Code — 47 patterns, PostToolUse hook, lossless recovery

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

SecretScan

**Real-time secret & credential detector for Claude Code.** Blocks API keys, tokens, private keys, and database passwords from ever entering your LLM context window.

[![Rust](https://img.shields.io/badge/Rust-1.70+-orange.svg)](https://www.rust-lang.org/) [![npm](https://img.shields.io/npm/v/@masyv/secretscan)](https://www.npmjs.com/package/@masyv/secretscan) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)

The Problem

When Claude Code runs tools, their outputs flow directly into the context window. That includes:

cat .env → your API keys
git log → commit messages with accidentally committed credentials
Database query results → connection strings, hashed passwords
curl responses → tokens, JWTs, session cookies

**SecretScan intercepts every tool output** before it reaches Claude, redacts detected secrets, and logs them locally. Claude sees `[REDACTED:anthropic_api_key:bbfc6912]` — not `sk-ant-api03-...`.

47 Built-in Patterns

Severity	Providers
🔴 Critical	Anthropic, OpenAI, AWS, GitHub, Stripe, Google Service Account, PostgreSQL, MySQL, MongoDB, PEM Private Keys
🟠 High	GitLab, Slack, npm, SendGrid, Cloudflare, Azure, Redis, Heroku, Vercel, Datadog, HuggingFace, Discord, Shopify
🟡 Medium	JWT tokens, Twilio, env file secrets, Slack webhooks
🔵 Low	Test keys, certificates, high-entropy strings

Plus **Shannon entropy analysis** for detecting unknown secrets by statistical pattern.

Quick Start

# Install from source
git clone https://github.com/Manavarya09/secretscan
cd secretscan
./scripts/build.sh && ./scripts/install.sh

# Auto-configure Claude Code
secretscan setup

# That's it — restart Claude Code and you're protected.

What It Looks Like

$ echo 'ANTHROPIC_API_KEY=sk-ant-api03-...' | secretscan scan

🚨  1 secret found:

  🔴 [CRITICAL]  Anthropic API Key   fingerprint: bbfc6912
             sk-ant-api03-xxxxx…
``