logSpecter – Schema-aware secret scanner for cloud logs (Regex + Shannon Entropy + JSON Path trackin

Jeffy123-zhu — Thu, 03 Sep 2026 02:26:46 +0000

Hey everyone,

I built logSpecter, an open-source secret scanner designed specifically for structured cloud logs.

What My Project Does
logSpecter scans large cloud log files (AWS CloudTrail, GCP Audit Logs, JSON dumps) to detect leaked API keys, tokens, and credentials.

JSON Path Tracking: Parses nested JSON and pinpoints the exact key path (e.g., requestParameters.headers.Authorization) where the leak happened.

Entropy + Regex: Combines regex detection with Shannon entropy analysis to eliminate false positives from random hashes or UUIDs.

Low-RAM Streaming: Processes multi-GB log archives using streaming without exhausting system memory.

CI/CD Integration: Supports pre-commit hooks, baselines, and exports to SARIF, JSON, CSV, or formatted tables.

Target Audience
Built for DevSecOps engineers, Cloud Security analysts, and developers who need to audit cloud log dumps or prevent secret leaks in log pipelines. It is ready for production CLI use and CI automation.

Comparison
vs. TruffleHog / Gitleaks: Standard scanners target git commit history and source code. When run on raw JSON logs, they output useless line numbers and flood you with hash false positives. logSpecter understands log schemas and gives exact JSON field paths.

vs. Ad-hoc Grep/Scripts: Provides streaming memory safety, SARIF integration for GitHub Security, and baseline suppression out of the box.

Links:

GitHub: https://github.com/Jeffy123-zhu/logspecter

PyPI: https://pypi.org/project/logspecter/

DEV Community: Jeffy123-zhu

logSpecter – Schema-aware secret scanner for cloud logs (Regex + Shannon Entropy + JSON Path trackin