Hey Dev,
I built Crenox — a lightweight pre-commit security hook that prevents accidental commits of API keys, passwords, and credentials before they ever reach your repository.
The core philosophy is simple: stop secrets at the edge, not after the damage is done. Remediating a leaked secret costs ~13× more than preventing it.
What makes it different:
Instead of regex-based matching, Crenox uses a Flat DFA Engine combined with Aho-Corasick multi-pattern matching on 92 known secret signatures, followed by Shannon entropy analysis for unknown secrets, and context-aware false-positive suppression.
The numbers speak:
Scanned 697 files (14.7 MB) from the kubernetes/kubectl repo in 43ms (Gitleaks: 5.25s on the same repo) Scanned 4,804 files (44 MB) from the Django repo in 212ms (Gitleaks: 7.5s) Zero dependencies, zero config needed — single static binary, ~7.5 MB Supports crenox:ignore for false positives, .crenox.yaml for customization, SARIF output for CI/CD Works on Linux, macOS, Windows, and even Android/Termux
Built by one developer because I was tired of secret scanners that were either too slow for pre-commit use or too expensive to run on every PR.
GitHub: https://github.com/crenoxhq/crenox
Website: https://crenoxhq.github.io/crenox
I'd love to hear your feedback — especially from anyone who runs secret scanning at scale. What's your biggest pain point with current tools?
Top comments (0)