Repo secret leak and .env drift check

What it does

Checks a repository for leaked credentials before you publish it or hand it over.

• Scans the working tree (tracked files plus untracked files that are not ignored) for AWS, GitHub, GitLab, Slack, Stripe, OpenAI, Anthropic, Google, SendGrid, npm, PyPI and Hugging Face key formats, private key blocks, JWTs, passwords embedded in connection strings, and high-entropy values in assignments like password = "..."
• Reports file:line with a masked value (e.g. ghp_******45 (len 40)); full secret values are never printed
• Flags .env files tracked by git and a .gitignore that does not cover .env
• --history also scans added lines in git log -p --all to find secrets and .env files that were ever committed
• Compares .env.example with env vars read in code (process.env, import.meta.env, os.environ, os.getenv, os.Getenv and more): used but undocumented, documented but not found in code
• Placeholder-looking values and values under test or fixture folders are shown at lower severity

How to use

python scripts/secret_scan.py . --json secret-report.json
python scripts/secret_scan.py . --history --max-commits 500

The agent verifies each hit (real secret, test value or false positive) and reports remediation with revoking and rotating the key first. Exit code is 1 when a HIGH finding exists, so it also works in CI.

Requirements

• Python 3 (standard library only)
• git for the history scan

Caveats

• Read-only: no edits, deletions or history rewrites (rewrites are only suggested).
• Pattern matching has false positives and false negatives. No findings means no known pattern matched.
• A secret that was ever pushed must be treated as leaked and rotated, even after removal.