secret-scanning

Infisical is the open-source platform for secrets management, PKI, and SSH access.

Protect your secrets using Gitleaks-Action

Scan for secrets in dangling commits on GitHub using GH Archive data.

Scan for secrets, endpoints, and other sensitive data after decompiling and deobfuscating Android files. (.apk, .xapk, .dex, .jar, .class, .smali, .zip, .aar, .arsc, .aab, .jadx.kts).

Examples of Custom Secret Scanning Patterns

Official TruffleHog Burp Suite Extension. Scan Burp Suite traffic for 800+ different types of secrets (API keys, passwords, SSH keys, etc) using TruffleHog.

GitHub Secret Scanning Auto Remediator (GSSAR)

collectvars collects JavaScript variables, highlights risky ones, and helps you understand code structure, while you casually browse.

All of our GitHub Actions rolled into one. Or as we like to say: One GitHub Action to rule them all!

A community-led project that aims to scan published Repls to find secrets and invalidate them.

Pipeleak is a tool designed to scan CI/CD logs and artifacts for secrets

A curated list of awesome GitHub Advanced Security secret scanning resources.

(in)secure git workshop 🔓+🔑 = 🔐

Open Source ASPM Platform

Testing Suite for GitHub Secret Scanning Custom Patterns

A repo full of secrets. This is designed to test SAST secret scanning tools.

Microsoft Teams notifier for Secret Scanning alerts from GitHub Advanced Security, using a GitHub App and Azure Function

Automate GitHub secret protection custom patterns

Secrets that were found by the Replit Token Scanner are dumped here for revocation.

CLI tool to transform verbose noseyparker JSON reports into concise JSON or CSV summaries for security analysis