CredScan
Hardcoded-secret scanner for source code, Infrastructure-as-Code, CI/CD pipelines, Docker, git history, and web endpoints, with confidence-scored detection and opt-in live verification of what it finds.
Secrets leak into git history quietly: a key pasted into a debug line, a token left in an old commit, and by the time anyone notices, it's already been pushed. A pattern match alone also can't tell you whether a string that looks like a key is still live.
Detection runs through four layers: pattern match, entropy, context, and a weighted confidence score, so lower-precision classes like generic passwords get reported without burying real findings in noise. Verification is opt-in and read-only, and a token is checked only against the provider that issued it (AWS via sts:GetCallerIdentity, GitHub, Slack, Stripe, and more); password-like findings can also be checked against HaveIBeenPwned using k-anonymity, so the secret itself never leaves the machine. The hosted GUI runs a separate, deliberately limited image with no path scanning, no git history, and no live validation, so a public demo can't be turned into a filesystem reader or a credential-checking oracle.
Knowing a string looks like a secret isn't the same as knowing it still works.
CredScan now covers 8 parser sources plus git history and web endpoints, verifies findings against their issuing provider instead of guessing, and ships public and local modes so the same tool is safe to host and full-powered on a trusted machine.
- Four-layer confidence scoring: pattern, entropy, context, and a weighted score
- Opt-in live verification against AWS, GitHub, Slack, Stripe, and more, read-only and provider-scoped
- Public hosted image is safe by construction: no path scanning, no git history, no validation