detect-secrets is a Python tool for detecting and preventing secrets in code.
The tool addresses the challenge of managing secrets in large codebases by taking an enterprise-focused approach that acknowledges existing secrets while preventing new ones from being introduced. Rather than attempting to scan entire repositories or git history, it runs periodic diffs against heuristically crafted regex patterns to identify newly committed secrets. This strategy avoids the overhead of comprehensive historical scans while establishing a baseline of currently known secrets, creating a separation of concerns that allows teams to prevent secret sprawl without immediately addressing legacy secrets.
The tool suits teams managing large repositories who need to prevent secret introduction while gradually migrating existing secrets to secure storage. It provides three distinct workflows: scanning to create or update baselines of known secrets, blocking new secrets via pre-commit hooks, and auditing baselines to label and prioritize secrets for migration. The project includes inline allowlisting for false positives and operates through a plugin system, allowing teams to enable or disable specific secret detection patterns based on their needs.
The project maintains active development with regular updates to its baseline format and plugin compatibility. The codebase receives ongoing refinement of its detection heuristics and continues to expand its documentation and configuration options. The tool is available through standard package installation methods and integrates with common development workflows through pre-commit framework support.
