scan-for-secrets
scan-for-secrets scans text files for user-supplied secret strings and common escaped variants, with optional confirmed redaction.
About this project
scan-for-secrets searches text files for secret values supplied by the user, including common escaped forms that a direct text match could miss. It can scan selected files or recursively scan directories while ignoring binary files. One documented use is checking coding-agent logs before sharing them publicly.
The Python command-line tool can be installed with pip or uv, or invoked through uvx. Users provide known values through the documented input methods and choose the files or directories to inspect. A default configuration can execute shell commands to obtain secrets, so that configuration must be treated as executable local content.
The code is Apache-2.0. Redaction lists matching locations and asks for confirmation before changing files in place, so originals should be backed up first. A clean exit means the supplied values were not found by this scan; it does not prove that all possible secrets or sensitive information have been removed.
Project sources
- Simon Willison
@simonw
Author release
The project author publishes the scan-for-secrets 0.3 release notes on their own website; this is an author release, not an X recommendation.
Source labels distinguish recommendations, neutral mentions and the author’s own releases. Commercial relationships are unknown unless an author relationship is shown. Worthary reviews project eligibility separately.
Why it is worth a look
- Find supplied secret strings in text files
- Match common escaped forms of known values
Before you use it
- Checks supplied values rather than discovering every possible secret
- Configuration commands execute locally and need review
- Redaction modifies files in place after confirmation
- Keep real credentials out of shared command examples and outputs
Checks supplied values rather than discovering every possible secret; Configuration commands execute locally and need review; Redaction modifies files in place after confirmation; Keep real credentials out of shared command examples and outputs; Confirmed requirements: Command line; Some requirements have not been verified. Check the official setup instructions.
What it can do
- Find supplied secret strings in text files
- Match common escaped forms of known values
- Optional confirmed redaction of matching content
Who it fits
Checking text logs for known credential values before sharing; Removing confirmed matches from copied text files
A complete secrets-detection or privacy guarantee; Redacting the only copy of important files without a backup
Getting started
- Install the official Python package with pip or uv, or use uvx
- Choose a limited set of files and the known values to check, following the documented input methods
- Inspect matches; back up files before using optional confirmed redaction