Summary
Running locally is the whole point — a secret scanner that uploads your code has defeated itself.
The thing being looked for is exactly the thing you must not send anywhere, so a scanner that ships your source to a service is solving the problem by creating it. Keeping the scan on the machine keeps that clean. Breadth of pattern coverage is what separates a useful secret scanner from a token one, and the list here covers the categories that actually appear in commit history. Pair it with an agent that can fix what it finds and the loop closes in one place.
What it is
A scanner that runs against code on your own machine, checking for the three things that leak most often: credentials committed by accident, dependencies with known holes, and unsafe code patterns.
What you get
- Secret detection across a wide pattern set — cloud access keys, repository and platform tokens, payment and messaging keys, database connection strings, JSON web tokens and private keys, package registry tokens
- Dependency vulnerability scanning
- Detection of insecure coding patterns
Requirements
Runs locally against your working copy.