detect-secrets
Yelp open source secrets scanner with a baseline workflow designed for enterprise adoption.
Technical Architecture & Overview
detect-secrets scans codebases for credentials using pattern plugins, entropy analysis, and heuristics, and its distinguishing feature is the baseline file: existing secrets are recorded once so only new leaks block the build. Pre-commit hooks and CI integration are first-class, and the companion detect-secrets-server stopped active development in 2021. Microsoft's Code-With Engineering Playbook includes a detect-secrets recipe for pre-commit and CI use.
Targeted Technical Use Cases
Introducing secret scanning into a codebase with a history, where blocking all existing findings is impractical.
Evaluation & Trade-offs
Core Strengths
- +Baseline model enables adoption without an initial fire drill.
- +Documented pre-commit hook blocks new secrets that are not in the baseline.
- +Plugin system extends detection.
Trade-Offs & Limitations
- -Baseline hygiene requires ongoing review.
- -Fewer detectors than commercial platforms.
Defensive Security Application
Preventing new secrets from entering source control while tracking a remediation baseline.
Frequently Asked Questions
What is detect-secrets?→
detect-secrets scans codebases for credentials using pattern plugins, entropy analysis, and heuristics, and its distinguishing feature is the baseline file: existing secrets are recorded once so only new leaks block the build. Pre-commit hooks and CI integration are first-class, and the companion detect-secrets-server stopped active development in 2021. Microsoft's Code-With Engineering Playbook includes a detect-secrets recipe for pre-commit and CI use.
What is detect-secrets used for?→
Introducing secret scanning into a codebase with a history, where blocking all existing findings is impractical.
What are the strengths of detect-secrets?→
- +Baseline model enables adoption without an initial fire drill.
- +Documented pre-commit hook blocks new secrets that are not in the baseline.
- +Plugin system extends detection.
What are the limitations of detect-secrets?→
- +Baseline hygiene requires ongoing review.
- +Fewer detectors than commercial platforms.
How is detect-secrets used defensively?→
Preventing new secrets from entering source control while tracking a remediation baseline.