<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Secret Detection — API Reference

## Gitleaks CLI

```bash
# Detect in current directory
gitleaks detect --source . --report-format json --report-path report.json

# Scan only staged changes (pre-commit)
gitleaks protect --staged --verbose

# Scan without git history
gitleaks detect --source . --no-git

# Scan specific commit range
gitleaks detect --source . --log-opts="--since='2024-01-01'"

# Custom config
gitleaks detect --source . --config .gitleaks.toml

# Verbose output
gitleaks detect --source . --verbose --report-format json
```

## TruffleHog CLI

```bash
# Git repo (verified only)
trufflehog git file://. --only-verified --json

# GitHub organization
trufflehog github --org=my-org --only-verified --json

# S3 bucket
trufflehog s3 --bucket=my-bucket --only-verified --json

# Filesystem
trufflehog filesystem /path/to/scan --json

# Specific branch
trufflehog git file://. --branch main --json
```

## detect-secrets

```bash
# Create baseline
detect-secrets scan > .secrets.baseline

# Audit baseline
detect-secrets audit .secrets.baseline

# Scan with baseline
detect-secrets scan --baseline .secrets.baseline

# Scan specific files
detect-secrets scan src/config.py
```

## BFG Repo-Cleaner

```bash
# Remove files containing secrets
bfg --delete-files '*.env' repo.git

# Replace text patterns
bfg --replace-text passwords.txt repo.git

# Clean up
git reflog expire --expire=now --all && git gc --prune=now --aggressive
```

## Common Secret Patterns

| Type | Pattern |
|------|---------|
| AWS Access Key | `AKIA[0-9A-Z]{16}` |
| GitHub Token | `gh[pousr]_[A-Za-z0-9_]{36,}` |
| Slack Token | `xox[baprs]-[0-9]{10,}` |
| Private Key | `-----BEGIN.*PRIVATE KEY-----` |
| Generic API Key | `(?i)api[_-]?key.*[:=].*[A-Za-z0-9]{20,}` |
