Stop catastrophic secret leaks before they happen. Professional-grade secret scanner that detects AWS keys, API tokens, passwords, and 50+ secret patterns with high accuracy.

⚠️ One leaked AWS key can cost $10,000+ in hours. GitSecure prevents that.

• ✨ 50+ High-Confidence Patterns - AWS, GitHub, Stripe, Slack, and more
• 🧠 Entropy Analysis - Detect generic secrets by randomness
• 📊 HTML Security Reports - Beautiful, shareable reports
• 🎯 Confidence Levels - HIGH/MEDIUM classification
• ⚡ Faster Scanning - Optimized pattern matching
• 📈 Repository Statistics - Detailed repo insights
• 🛡️ Enhanced .gitignore - Comprehensive protection rules

GitSecure is dual-licensed for maximum flexibility:

Free for individuals, open source projects, and evaluation. Perfect for:

• Personal projects
• Open source contributions
• Learning and testing
• Non-commercial use

Required for:

• ✅ Commercial/closed-source projects
• ✅ Companies with 5+ developers
• ✅ Products/services using GitSecure
• ✅ Enterprise deployments

Benefits:

• ⚡ Priority support & SLA guarantees
• 📞 Direct communication channel
• 🎯 Feature requests & custom integrations
• 📋 Compliance assistance
• 💼 Commercial indemnification
• 🔒 Advanced features (team dashboard, SSO, audit trails)

📧 Contact for Commercial Licensing | 💰 View Pricing

Using GitSecure personally or in open source? Consider sponsoring!

Your sponsorship helps:

• 🔍 More secret pattern detection
• ⚡ Faster scanning algorithms
• 🌍 Better multi-language support
• 📚 Comprehensive documentation
• 🆕 Free security tools for everyone

Tiers: Individual $5/mo | Supporter $15/mo | Business Custom

Secret leaks are catastrophic and expensive:

• 💸 AWS keys leaked → $10,000+ charges in hours
• 🔓 API tokens exposed → Data breaches & compliance violations
• 🗄️ Database credentials committed → Complete security compromise
• 💔 One mistake can destroy a company

GitSecure provides automated, professional-grade secret detection:

• 🛡️ Scan before every commit (pre-commit hook)
• 🎯 Detect 50+ specific secret patterns with high accuracy
• 🧠 Entropy analysis for generic secrets
• 🚫 Block dangerous commits automatically
• 📊 Audit entire repository history
• 📈 Generate beautiful HTML reports
• ⚡ Zero false positives on well-tuned patterns

curl -sSL https://raw.githubusercontent.com/strabo231/gitsecure/main/install.sh | bash

# Download
curl -O https://raw.githubusercontent.com/strabo231/gitsecure/main/gitsecure
chmod +x gitsecure

# Move to PATH
sudo mv gitsecure /usr/local/bin/
# or for user install
mkdir -p ~/.local/bin && mv gitsecure ~/.local/bin/

gitsecure --version
# Should output: gitsecure version 2.0.0

cd your-repo
gitsecure install-hook

Now every commit is automatically scanned for secrets! 🔒

# Make changes
git add .

# Scan before commit
gitsecure scan

# Check all tracked files for secrets
gitsecure audit

# Create beautiful HTML report
gitsecure report

# Opens automatically in browser

• ✅ AWS - Access Keys, Secret Keys, Session Tokens
• ✅ GitHub - PAT, OAuth, App Tokens, Refresh Tokens
• ✅ Stripe - Live Keys, Secret Keys, Restricted Keys
• ✅ Google Cloud - API Keys, OAuth Tokens, Service Accounts
• ✅ Slack - Bot Tokens, Webhooks, Legacy Tokens
• ✅ Private Keys - RSA, SSH, EC, PGP, DSA
• ✅ Database URLs - PostgreSQL, MySQL, MongoDB, Redis
• ✅ Twilio - API Keys, Account SIDs
• ✅ SendGrid - API Keys
• ✅ Discord - Bot Tokens, Webhooks
• ✅ Telegram - Bot Tokens
• ✅ DigitalOcean - Personal Access Tokens
• ✅ Heroku - API Keys
• ✅ Azure - Storage Keys, Connection Strings

• ⚠️ JWT Tokens
• ⚠️ Generic API Keys
• ⚠️ Generic Secrets & Tokens
• ⚠️ Bearer Tokens
• ⚠️ Passwords in Code

• 🔒 .env, .env.* files
• 🔒 Private key files (.pem, .key, id_rsa)
• 🔒 Certificate files (.p12, .pfx)
• 🔒 Config files (credentials.json, secrets.json)

• 🧠 Entropy Analysis - Detects high-randomness strings (likely secrets)
• 📁 Smart File Filtering - Ignores binary/minified files
• 🎯 Context-Aware - Understands code structure

Scans files staged for commit. Perfect for pre-commit hooks.

gitsecure scan

Scans all tracked files in the repository.

gitsecure audit

Scan a single file with detailed output.

gitsecure check config.json
gitsecure check .env.production

List all secret patterns GitSecure can detect.

gitsecure patterns

Adds comprehensive secret protection rules to .gitignore.

gitsecure protect

Installs automatic scanning on every commit.

gitsecure install-hook

Removes the pre-commit hook.

gitsecure uninstall-hook

Creates a beautiful, shareable security report.

gitsecure report
# Opens in browser automatically

Show repository metrics and security status.

gitsecure stats

The pre-commit hook is the most powerful feature - it automatically scans every commit and blocks secrets from entering your repository.

cd your-repository
gitsecure install-hook

1. You stage files with git add
2. You run git commit
3. GitSecure automatically scans staged files
4. If secrets found → commit is blocked ❌
5. If clean → commit proceeds ✅

$ git commit -m "Add config"
🔍 GitSecure: Scanning for secrets...

═══════════════════════════════════════════════════════════════
              🔍 SCANNING STAGED FILES FOR SECRETS
═══════════════════════════════════════════════════════════════

🚨 AWS Access Key detected: config.py
  → Line 5: [REDACTED for security]

═══════════════════════════════════════════════════════════════
                        📊 SCAN RESULTS
═══════════════════════════════════════════════════════════════

🚨 Found 1 potential secret(s) in staged files
🛑 COMMIT BLOCKED - DO NOT COMMIT!

🔧 Recommended Actions:
  → 1. Remove secrets from files
  → 2. Use environment variables instead
  → 3. Add sensitive files to .gitignore

# Only if you're absolutely sure
git commit --no-verify

Generate professional security reports perfect for:

• 📋 Compliance audits
• 👥 Team reviews
• 📈 Security tracking
• 🗂️ Documentation

gitsecure report

Features:

• 🎨 Beautiful, modern design
• 📊 Visual metrics & statistics
• 🔍 Detailed scan results
• 💡 Actionable recommendations
• 📤 Easy sharing & archiving

1. Install pre-commit hook - Prevent secrets from entering repo
2. Use environment variables - Never hardcode secrets
3. Use secret management - Vault, AWS Secrets Manager, Doppler
4. Generate .gitignore protection - Run gitsecure protect
5. Regular audits - Run gitsecure audit monthly
6. Rotate exposed secrets immediately - Assume compromised

1. Don't commit secrets - Even in private repos
2. Don't rely on deleting commits - Secrets remain in history
3. Don't store secrets in code - Use environment variables
4. Don't ignore warnings - Every detection matters
5. Don't use --no-verify - Defeats the purpose

Default: 4.5 (detects high-randomness strings)

# Edit in gitsecure script
ENTROPY_THRESHOLD=4.5

Default: 20 characters

# Edit in gitsecure script
MIN_SECRET_LENGTH=20

Add custom patterns by editing the SECRET_PATTERNS array in the script.

Run the comprehensive test suite:

./test-gitsecure.sh

Tests cover:

• ✅ All secret pattern detection
• ✅ File scanning accuracy
• ✅ Pre-commit hook functionality
• ✅ .gitignore generation
• ✅ Clean file handling (no false positives)

We welcome contributions! See CONTRIBUTING.md for guidelines.

Areas we need help:

• 🔍 Additional secret patterns
• 🌍 Language-specific patterns
• ⚡ Performance improvements
• 📚 Documentation
• 🧪 More test cases

Free for individuals and open source projects. See LICENSE-GPL3.

Commercial license required for businesses. See COMMERCIAL.md for pricing.

• 💬 GitHub Discussions
• 🐛 Report Issues
• 💼 Commercial Licensing
• 💖 Become a Sponsor

If GitSecure saved you from a secret leak, please star the repository!

• 50+ Secret Patterns detected
• Zero Configuration required
• One-Line Install in seconds
• 100% Bash - No dependencies
• Used by 1000+ developers worldwide (growing!)

• 📖 Pattern Examples - See what gets detected
• 🔧 Best Practices Guide
• 🏢 Enterprise Guide
• 🔌 CI/CD Integration

Built with ❤️ by strabo231 | Securing developers worldwide 🔒

Remember: The best secret is the one that never gets committed.