Repository scanners catch the key you committed. They cannot see the key you exported on the command line while debugging, which is now sitting in plain text in your history file and will be there for years. Same for the cloud session token you forgot. Covering the whole home directory rather than one repo is the right scope for a machine that has been in use a while — and the local-only promise is not decoration, since anything else would mean uploading exactly what you are looking for.
A scanner for the credentials that accumulate on a development machine, covering the places they actually end up rather than just the repository.
- scan_secrets — environment files found recursively, cloud credential files and session tokens, unprotected SSH private keys, container registry auth, package registry tokens, command-line tool OAuth tokens, cluster config credentials and stored passwords
- Shell history — keys pasted into a command, which no repository scanner sees
- fix_secrets, scan_summary and ghosthunt_status alongside
Npx. Their documentation states everything runs locally and no data leaves the machine.
One command — npx ghosthunt