DEV Community

Venture Studios
Venture Studios

Posted on

Stop Leaking Secrets: A Dependency-Free Python CLI to Catch API Keys Before You Commit

#security #python #opensource #cli

The Problem

Every week, thousands of API keys, AWS credentials, and private keys get committed to git repos and leaked publicly. Most scanners are SaaS-only, require signup, or drag in huge dependency trees.

The Fix: secret_scanner

A single-file, dependency-free Python CLI that scans your codebase for leaked secrets before they hit git history or production.

Detects:

  • AWS access keys & secret keys
  • GitHub tokens (classic + fine-grained)
  • JWTs
  • Private key blocks (RSA/PEM)
  • Generic high-entropy strings (catches custom API keys)

Why it's different:

  • No install beyond optional deps - drop the .py file in and run
  • Works in CI (GitHub Actions) or as a pre-commit hook
  • No signup, no SaaS lock-in, no telemetry

Try it

$29 one-time, instant delivery via Stripe:
https://buy.stripe.com/00w28t6Ut3zUcZr7zRaR20b

Example usage 

python scanner.py --path ./my-repo
Enter fullscreen mode Exit fullscreen mode

Happy to answer questions about detection patterns or CI integration in the comments.

Top comments (0)