detect-secrets
Yelp open source secrets scanner with a baseline workflow designed for enterprise adoption.
Technical Architecture & Overview
detect-secrets scans codebases for credentials using pattern plugins, entropy analysis, and heuristics, and its distinguishing feature is the baseline file: existing secrets are recorded once so only new leaks block the build. Pre-commit hooks and CI integration are first-class, and a companion server tool tracks repositories over time. Microsoft engineering guidance uses it as a reference scanner.
Targeted Technical Use Cases
Introducing secret scanning into a codebase with a history, where blocking all existing findings is impractical.
Evaluation & Trade-offs
Core Strengths
- +Baseline model enables adoption without an initial fire drill.
- +Pre-commit and CI paths are well documented.
- +Plugin system extends detection.
Trade-Offs & Limitations
- -Baseline hygiene requires ongoing review.
- -Fewer detectors than commercial platforms.
Defensive Security Application
Preventing new secrets from entering source control while tracking a remediation baseline.
Frequently Asked Questions
What is detect-secrets?→
detect-secrets scans codebases for credentials using pattern plugins, entropy analysis, and heuristics, and its distinguishing feature is the baseline file: existing secrets are recorded once so only new leaks block the build. Pre-commit hooks and CI integration are first-class, and a companion server tool tracks repositories over time. Microsoft engineering guidance uses it as a reference scanner.
What is detect-secrets used for?→
Introducing secret scanning into a codebase with a history, where blocking all existing findings is impractical.
What are the strengths of detect-secrets?→
- +Baseline model enables adoption without an initial fire drill.
- +Pre-commit and CI paths are well documented.
- +Plugin system extends detection.
What are the limitations of detect-secrets?→
- +Baseline hygiene requires ongoing review.
- +Fewer detectors than commercial platforms.
How is detect-secrets used defensively?→
Preventing new secrets from entering source control while tracking a remediation baseline.