I’ve been building SecretLoop, and it’s now available in Preview on Open VSX.
The problem I was trying to solve is pretty simple.
You run a secret scanner and get:
“Found an API key.”
Cool. But then what?
Is it still active?
Was it already revoked?
Is it buried somewhere in Git history?
Do I need to rotate it?
And how do I actually remove it without manually hunting through the code?
SecretLoop is built around this flow:
Detect → Verify → Remediate
What it does
- Scans your working tree, staged files and Git history
- Uses 100+ provider rules + entropy detection
- Can verify supported credentials against their provider to determine whether they're currently live
- Shows findings directly in VS Code
- Provides quick fixes to redact a secret or move it to
.env - Supports rotation where the provider API allows it
- Includes pre-commit and CI/SARIF support
- Has an MCP server for AI coding agents
The MCP part was particularly important to get right.
SecretLoop doesn't have an LLM inside it. The scanner produces deterministic findings; the AI assistant can explain and work with those findings.
Credential values are always redacted in MCP responses, and verification is opt-in and requires explicit human approval before a credential is sent to its provider.
You can try it without installing anything:
npx secretloop scan
Or scan Git history:
npx secretloop history
For CI:
npx secretloop scan --format sarif -o results.sarif
Open VSX:
GitHub:
It's still early/Preview, so I'm much more interested in feedback than downloads.
If you use gitleaks, TruffleHog, GitGuardian, GitHub Secret Scanning, etc., I'd especially love to know:
What happens after your scanner finds a secret?
That's the part I'm trying to improve.
Top comments (0)