How I Built Secret-Scrub: A Zero-Dependency Pre-Commit Secret Scanner with Shannon Entropy Analysis

Описание и применение

Secret‑Scrub – это инструмент без зависимостей, который блокирует коммиты с секретами, используя распознавание шаблонов и анализ энтропии, и устанавливается одним кликом как pre‑commit‑hook.

Задача

Developers accidentally commit secrets (e.g., .env files, hard‑coded AWS keys) to public GitHub repos, exposing credentials within seconds and requiring immediate rotation.

Результат

Secret‑Scrub prevents accidental secret commits by detecting known vendor patterns and high‑entropy strings, aborting the commit locally in under 40 ms for staged files, and providing a simple 1‑click hook installer.

Рабочий процесс

• Install Secret‑Scrub via npx: npx secret-scrub install-hook to add a pre‑commit hook.
• Stage changes in Git as usual.
• Attempt to commit: the pre‑commit hook runs Secret‑Scrub on staged files.
• If a secret is detected, the hook aborts the commit and reports the offending string.
• If no secrets are found, the commit proceeds normally.
• Optionally run npx secret-scrub --staged manually for quick scans or npx secret-scrub . --format json for CI pipelines.

Доказательства

Secret‑Scrub combines two complementary inspection layers: Vendor Signature Matching and Shannon Entropy Analysis.

Источник

Scanning thousands of files on every commit slows down developers. Secret‑Scrub solves this with --staged mode… takes less than 40 milliseconds.

Источник

npx secret-scrub install-hook automatically configures .git/hooks/pre-commit.

Источник