CredScan
Hardcoded-secret scanner for source code, Infrastructure-as-Code, CI/CD pipelines, Docker, git history, and web endpoints, with confidence-scored detection and opt-in live verification of what it finds.
Secrets leak into git history quietly: someone pastes a key into a debug line, or leaves a token in an old commit. By the time anyone notices, it has already been pushed. A pattern match alone also can't tell you whether a string that looks like a key is still live.
Detection runs through four layers: pattern match, entropy, context, and a weighted confidence score. This lets lower-precision classes like generic passwords get reported without burying real findings in noise. Verification is opt-in and read-only. CredScan checks a token only against the provider that issued it (AWS via sts:GetCallerIdentity, GitHub, Slack, Stripe, and more). Password-like findings can also be checked against HaveIBeenPwned using k-anonymity, so the secret itself never leaves the machine. The hosted GUI runs a separate, deliberately limited image with no path scanning, no git history, and no live validation. This keeps a public demo from becoming a filesystem reader or a credential-checking oracle.
Knowing a string looks like a secret isn't the same as knowing it still works.
CredScan now covers 8 parser sources plus git history and web endpoints. It verifies findings against their issuing provider instead of guessing. It also ships public and local modes, so the same tool is safe to host and full-powered on a trusted machine.
- Four-layer confidence scoring: pattern, entropy, context, and a weighted score
- Opt-in live verification against AWS, GitHub, Slack, Stripe, and more, read-only and provider-scoped
- Public hosted image is safe by construction: no path scanning, no git history, no validation