SecuSecret · Secrets detection
Find the credentials your repos are hiding
API keys, tokens, and passwords leak into code, git history, and build artifacts. SecuSecret walks all of it - including archives and encodings - entirely offline, and fingerprints every finding so it stays triaged.
$ secusecret scan --git-history .
commits walked 12,408 · archives opened 37
finding · cloud key · config/prod.env
finding · database url · docker-compose.yml
baseline applied · 0 new since last scan
✓ findings fingerprinted
How it works
01
Scan everything
Working tree, full git history, and archives. Encoded and compressed content is decoded before matching.
02
Detect with context
Provider-aware detection distinguishes a real cloud key from a random string, keeping results actionable.
03
Stay quiet, stay honest
Baselines and stable fingerprints mean CI only alerts on new leaks, while known findings stay tracked until rotated.
Why teams choose SecuSecret
History-deep scanning
A secret deleted last year is still a secret. Full git history and archive contents are in scope.
Layered decoding
Base64, nested archives, and common encodings are unwrapped so hidden credentials cannot hide.
Stable fingerprints
Each finding gets a content-based fingerprint, so triage decisions survive rescans and repo moves.
Fully offline
No secret ever leaves your network for validation. Detection logic runs entirely locally.
Frequently asked questions
Does it send my secrets anywhere to verify them?
No. Everything runs inside your network. SecuSecret never transmits candidate secrets to external services for validation.
How does it avoid drowning teams in false alarms?
Detection is provider-aware and context-sensitive, and baseline files let you acknowledge historical findings so pipelines only fail on new leaks.
Can it scan build artifacts and containers?
Yes. Archives and layered artifacts are unpacked and decoded during the scan, so credentials baked into packages are found too.
See SecuSecret run on your own code, in your own network.
Request a demo