How I Built Secret-Scrub: A Zero-Dependency Pre-Commit Secret Scanner with Shannon Entropy Analysis

Description and use

Secret‑Scrub is a zero‑dependency tool that blocks commits containing secrets by combining vendor signature matching and Shannon entropy analysis, and can be installed with a single click as a pre‑commit hook.

Problem

Developers accidentally commit secrets (e.g., .env files, hard‑coded AWS keys) to public GitHub repos, exposing credentials within seconds and requiring immediate rotation.

Outcome

Secret‑Scrub prevents accidental secret commits by detecting known vendor patterns and high‑entropy strings, aborting the commit locally in under 40 ms for staged files, and providing a simple 1‑click hook installer.

Workflow

• Install Secret‑Scrub via npx: npx secret-scrub install-hook to add a pre‑commit hook.
• Stage changes in Git as usual.
• Attempt to commit: the pre‑commit hook runs Secret‑Scrub on staged files.
• If a secret is detected, the hook aborts the commit and reports the offending string.
• If no secrets are found, the commit proceeds normally.
• Optionally run npx secret-scrub --staged manually for quick scans or npx secret-scrub . --format json for CI pipelines.

Evidence

Secret‑Scrub combines two complementary inspection layers: Vendor Signature Matching and Shannon Entropy Analysis.

Source

Scanning thousands of files on every commit slows down developers. Secret‑Scrub solves this with --staged mode… takes less than 40 milliseconds.

Source

npx secret-scrub install-hook automatically configures .git/hooks/pre-commit.

Source