I’ve been experimenting with DevSecOps tools lately — but wanted to try a challenge of solving a specific problem.
Most secret scanners only alert you after you’ve already pushed your code.
By then, it’s too late.
So I decided to build something different:
A fast, lightweight local-first secrets scanner that runs before commits, works offline, and never sends your code anywhere.
*Why I Built It
Every year, thousands of API keys get exposed in public repos.
Even tools like GitGuardian or Gitleaks don’t stop this fully because:
Developers forget to run them before pushing
CI-only scanners catch leaks after the fact
Some tools require cloud setup or telemetry access
I wanted a tool that fits naturally into a developer’s workflow,and runs locally.
*What It Does
Scans files and commits for API keys, tokens, and credentials
Runs automatically before commits (python -m app.cli --staged)
Works as a CLI, pre-commit hook, or self-hosted web UI
Outputs SARIF reports, supports baselines, and runs fully offline
Integrates with CI for optional automation
*New Features Since Launch
I recently added a few upgrades based on early feedback:
Baseline support to avoid false positives
SARIF output for CI integration
Per-repo config for custom ignore patterns
Next: --fix mode to auto-redact or hint key rotation
*Why “Local-First” Matters
Most teams trust cloud scanners with private code — I wanted to try the opposite of that model.
Secrets Scanner runs on your machine or on your own server, so:
No code ever leaves your environment
You stay compliant and private
You can integrate it with any workflow
Quick Demo
Pre-commit scan
python -m app.cli --staged
Or full repo
python -m app.cli .
Optional: generate SARIF
python -m app.cli --sarif report.sarif
If it finds something:
HIGH · STRIPE_SECRET_KEY · app/settings.py:42
Otherwise:
No secrets found.
How to Try It
GitHub: github.com/AMOSFinds/secrets-scanner
Live demo: secrets-scanner-jlw2.onrender.com
If you’d like to help test, I have a few private API keys available for early users, just comment below or DM me.
*What I Learned
Building this taught me how critical it is to combine developer efficiency with security.
*Feedback Wanted
I’m looking for 5–10 testers to try the pre-commit integration and let me know if it is genuinely helpful or lackluster.
What do you think — is a fully local scanner like this a must-have for small teams?
Top comments (0)