I built a secret scanner that tries to answer “is this secret actually live?"

priyanka kesharwani — Tue, 08 Sep 2026 19:14:51 +0000

I’ve been building SecretLoop, and it’s now available in Preview on Open VSX.

The problem I was trying to solve is pretty simple.

You run a secret scanner and get:

“Found an API key.”

Cool. But then what?

Is it still active?
Was it already revoked?
Is it buried somewhere in Git history?
Do I need to rotate it?
And how do I actually remove it without manually hunting through the code?

SecretLoop is built around this flow:

Detect → Verify → Remediate

What it does

Scans your working tree, staged files and Git history
Uses 100+ provider rules + entropy detection
Can verify supported credentials against their provider to determine whether they're currently live
Shows findings directly in VS Code
Provides quick fixes to redact a secret or move it to .env
Supports rotation where the provider API allows it
Includes pre-commit and CI/SARIF support
Has an MCP server for AI coding agents

The MCP part was particularly important to get right.

SecretLoop doesn't have an LLM inside it. The scanner produces deterministic findings; the AI assistant can explain and work with those findings.

Credential values are always redacted in MCP responses, and verification is opt-in and requires explicit human approval before a credential is sent to its provider.

You can try it without installing anything:

npx secretloop scan

Or scan Git history:

npx secretloop history

For CI:

npx secretloop scan --format sarif -o results.sarif

Open VSX:

SecretLoop – Open VSX

GitHub:

SecretLoop on GitHub

It's still early/Preview, so I'm much more interested in feedback than downloads.

If you use gitleaks, TruffleHog, GitGuardian, GitHub Secret Scanning, etc., I'd especially love to know:

What happens after your scanner finds a secret?

That's the part I'm trying to improve.

DEV Community: priyanka kesharwani

I built a secret scanner that tries to answer “is this secret actually live?"

What it does