{"_id":"@danny1214/secretsweep","_rev":"4-9f8437c0399165aa863d4828d14ff2fb","name":"@danny1214/secretsweep","dist-tags":{"latest":"1.1.1"},"versions":{"1.0.0":{"name":"@danny1214/secretsweep","version":"1.0.0","keywords":["secrets","security","scanner","cli","credentials","leak-detection"],"author":{"name":"Ceibo"},"license":"MIT","_id":"@danny1214/secretsweep@1.0.0","maintainers":[{"name":"danny1214","email":"dandylopez37@gmail.com"}],"bin":{"secretsweep":"bin/secretsweep.js"},"dist":{"shasum":"98508be03e5f5bdacedd1fa1e8af28f4c2ca784f","tarball":"https://registry.npmjs.org/@danny1214/secretsweep/-/secretsweep-1.0.0.tgz","fileCount":9,"integrity":"sha512-t2qCPCzASFuO5HCY9h75+DFuQEES9fZOvcLgWB2LK/xxMHJXm6/KZUcp+3isu2/x4NeZ/A8+kESrNW6GfcGySA==","signatures":[{"sig":"MEUCIQD4PQZRYrC8GeHtBPlzKk+OWSq9k8Obyv9x9ywUSllD4wIgG9s5HN8pGjlWhrFrwAiWke0Q92SiP7QJgHv9jlktwSE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":19519},"main":"lib/scanner.js","engines":{"node":">=14"},"gitHead":"1d081f919ac7ae644bbac0950f37b92034677880","scripts":{"test":"node test/scanner.test.js"},"_npmUser":{"name":"danny1214","email":"dandylopez37@gmail.com"},"_npmVersion":"10.9.8","description":"A fast, dependency-free CLI to scan files and directories for leaked secrets (API keys, tokens, private keys, passwords, connection strings).","directories":{},"_nodeVersion":"22.23.2","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/secretsweep_1.0.0_1785554591243_0.4207754439046696","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"@danny1214/secretsweep","version":"1.0.1","keywords":["secrets","security","scanner","cli","credentials","leak-detection"],"author":{"name":"Ceibo"},"license":"MIT","_id":"@danny1214/secretsweep@1.0.1","maintainers":[{"name":"danny1214","email":"dandylopez37@gmail.com"}],"bin":{"secretsweep":"bin/secretsweep.js"},"dist":{"shasum":"530bcfe6d7c00c9da826cd7b19fce0a0b76a9928","tarball":"https://registry.npmjs.org/@danny1214/secretsweep/-/secretsweep-1.0.1.tgz","fileCount":5,"integrity":"sha512-XO1yWxDJ2D6Uj2yr0A3OSUVBIs5PpfaVw/+cW0W9aaH+oMdnz0du78uDk32aySV5urae0g4Ct4JDi6LHrBOf4Q==","signatures":[{"sig":"MEYCIQCVTsDAsYhrZCzi3o/DCtekNIdCmbK3+JKiACyVnvZYqAIhAO7g/AKU61AjB4Lo4A06+23upnSUlqU4pXaCBmQPYado","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":13447},"main":"lib/scanner.js","engines":{"node":">=14"},"gitHead":"67f48b482ecb1a07c1f46a28380fcb0812868a3e","scripts":{"test":"node test/scanner.test.js"},"_npmUser":{"name":"danny1214","email":"dandylopez37@gmail.com"},"_npmVersion":"10.9.8","description":"A fast, dependency-free CLI to scan files and directories for leaked secrets (API keys, tokens, private keys, passwords, connection strings).","directories":{},"_nodeVersion":"22.23.2","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/secretsweep_1.0.1_1785610849252_0.7072287932380485","host":"s3://npm-registry-packages-npm-production"}},"1.1.0":{"name":"@danny1214/secretsweep","version":"1.1.0","keywords":["secrets","security","scanner","cli","credentials","leak-detection","git-history"],"author":{"name":"Ceibo"},"license":"MIT","_id":"@danny1214/secretsweep@1.1.0","maintainers":[{"name":"danny1214","email":"dandylopez37@gmail.com"}],"bin":{"secretsweep":"bin/secretsweep.js"},"dist":{"shasum":"132b6c87f6c44fa010d655ad571d9941209a6e9e","tarball":"https://registry.npmjs.org/@danny1214/secretsweep/-/secretsweep-1.1.0.tgz","fileCount":6,"integrity":"sha512-r34+grn/8YDZfSAiPV3yiEIF+vBtiBKFhQcJSGvh9ak702c96jXHTA+u6sKmK8UL73tmuNTiUkcWdAZ3V4SjXw==","signatures":[{"sig":"MEUCIEWAXcIDcSY6FBe99w7q+JYtGiGmbR8cpg+m6CF2FP34AiEAqiukj+NquY7ztrQG9XeeORBBR/B0gQk27xMxXtOAaOU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":21872},"main":"lib/scanner.js","engines":{"node":">=14"},"gitHead":"4f29d96ff2d001c9828a6d3c39e5758851d7d031","scripts":{"test":"node test/scanner.test.js && node test/gitHistory.test.js"},"_npmUser":{"name":"danny1214","email":"dandylopez37@gmail.com"},"_npmVersion":"10.9.8","description":"A fast, dependency-free CLI to scan files and directories for leaked secrets (API keys, tokens, private keys, passwords, connection strings) -- including full git commit history, not just current files.","directories":{},"_nodeVersion":"22.23.2","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/secretsweep_1.1.0_1785625250164_0.8272105788548323","host":"s3://npm-registry-packages-npm-production"}},"1.1.1":{"name":"@danny1214/secretsweep","version":"1.1.1","description":"A fast, dependency-free CLI to scan files and directories for leaked secrets (API keys, tokens, private keys, passwords, connection strings).","main":"lib/scanner.js","bin":{"secretsweep":"bin/secretsweep.js"},"scripts":{"test":"node test/scanner.test.js"},"keywords":["secrets","security","scanner","cli","credentials","leak-detection"],"license":"MIT","author":{"name":"Ceibo"},"engines":{"node":">=14"},"_id":"@danny1214/secretsweep@1.1.1","gitHead":"4c3df439ea743a8da7542fd2abbb84e14ebf8e2e","_nodeVersion":"22.23.2","_npmVersion":"10.9.8","dist":{"integrity":"sha512-cDeTrjgSwdlToNzOb22GpuwsI7px8Iw5NoT/Co0WLymPIICb/a0OB1XmjvPhIHkWYF/8f+CuJe4ppxvEz5X2Dg==","shasum":"74a7b700e824af7086fb9b3128613b7b6242a8f2","tarball":"https://registry.npmjs.org/@danny1214/secretsweep/-/secretsweep-1.1.1.tgz","fileCount":9,"unpackedSize":19543,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQD92oy0kKAyMZUyGI7HSM8EdHENVHruMAP2/88bNuxvmgIgJwi/nJS3J21psno76NkrsZHXMgILOTujNPti1JjdOu4="}]},"_npmUser":{"name":"danny1214","email":"dandylopez37@gmail.com"},"directories":{},"maintainers":[{"name":"danny1214","email":"dandylopez37@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/secretsweep_1.1.1_1785747622311_0.26367723605673166"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-01T03:23:11.133Z","modified":"2026-08-03T09:00:22.621Z","1.0.0":"2026-08-01T03:23:11.397Z","1.0.1":"2026-08-01T19:00:49.422Z","1.1.0":"2026-08-01T23:00:50.298Z","1.1.1":"2026-08-03T09:00:22.465Z"},"author":{"name":"Ceibo"},"license":"MIT","keywords":["secrets","security","scanner","cli","credentials","leak-detection"],"description":"A fast, dependency-free CLI to scan files and directories for leaked secrets (API keys, tokens, private keys, passwords, connection strings).","maintainers":[{"name":"danny1214","email":"dandylopez37@gmail.com"}],"readme":"# secretsweep\n\nA fast, dependency-free CLI to scan files and directories for leaked secrets:\nAPI keys, tokens, private keys, passwords, and database connection strings.\n\n## What it does\n\nRecursively walks a file or directory and checks every line of every text file\nagainst a set of pattern rules (AWS keys, GitHub/Slack/Stripe/Google tokens,\nJWTs, PEM private key blocks, hardcoded passwords, DB connection strings with\nembedded credentials), plus an optional high-entropy fallback for values\nassigned to suspicious-looking variable names (e.g. `my_token = \"...\"`).\n\nMatched secrets are **redacted** in all output (first 4 / last 4 characters\nshown, middle replaced with `...`) — the raw secret value is never printed.\n\nBinary files, common vendor/build directories (`.git`, `node_modules`, `dist`,\netc.), and files over 5MB are skipped automatically.\n\n## Install\n\n```bash\nnpm install -g @danny1214/secretsweep\nsecretsweep --help\n```\n\nRequires Node.js >= 14. No dependencies.\n\n### From source (contributing / local dev only)\n\n```bash\ngit clone <this-repo>\ncd secretsweep\nchmod +x bin/secretsweep.js\nnode bin/secretsweep.js --help\n```\n\n## Usage\n\n```bash\nsecretsweep <path> [options]\n```\n\nOptions:\n\n- `--json` — output findings as JSON instead of human-readable text\n- `--no-entropy` — disable the high-entropy fallback detector (fewer false positives, may miss unknown secret formats)\n- `--severity <level>` — only show findings at or above this severity: `critical`, `high`, `medium`, `low` (default: `low`, shows everything)\n- `-h, --help` — show help\n\nExit codes: `0` = no findings, `1` = findings detected, `2` = invalid usage.\n\n### Example\n\n```bash\n$ secretsweep ./test/fixtures\nScanned 2 file(s), skipped 0, total 2.\n\n[CRITICAL] /path/test/fixtures/leaky.txt:5 (private-key-block)\n  PEM-format private key block\n  match: -----...KEY-----\n  context: -----BEGIN RSA PRIVATE KEY-----\n\n[HIGH] /path/test/fixtures/leaky.txt:2 (aws-secret-key)\n  ...\n\nFound 5 potential secret(s).\n```\n\n## Running tests\n\n```bash\nnpm test\n```\n\nExpected output: `8 passed, 0 failed`.\n\n## Limits\n\n- **Pattern-based, not perfect.** Rules match known secret formats (AWS,\n  GitHub, Slack, Stripe, Google, JWT, PEM keys) plus generic\n  password/API-key/connection-string patterns. Novel or obfuscated secret\n  formats can be missed. This is a triage tool, not a guarantee.\n- **False positives are possible**, especially from the entropy fallback\n  detector on non-secret high-entropy strings (hashes, encoded IDs, etc.).\n  Use `--no-entropy` to reduce noise, or `--severity high` to focus on\n  higher-confidence rule matches.\n- **No git history scanning.** Only scans the current state of files on disk,\n  not prior commits. A secret that was committed and later removed will not\n  be found by this tool.\n- **Line-based matching only.** Secrets split across multiple lines (other\n  than the explicitly handled PEM key block) will not be detected.\n- **Not a replacement for secret rotation.** If secretsweep finds something,\n  treat the credential as compromised and rotate it — don't just remove it\n  from the file.\n\n## License\n\nMIT\n","readmeFilename":"README.md"}