How I Built Secret-Scrub: A Zero-Dependency Pre-Commit Secret Scanner with Shannon Entropy Analysis

说明与用途

Secret‑Scrub 是一个零依赖工具，通过结合供应商签名匹配和香农熵分析，在本地阻止包含秘密的提交，并可一键安装为 pre‑commit 钩子。

问题

Developers accidentally commit secrets (e.g., .env files, hard‑coded AWS keys) to public GitHub repos, exposing credentials within seconds and requiring immediate rotation.

结果

Secret‑Scrub prevents accidental secret commits by detecting known vendor patterns and high‑entropy strings, aborting the commit locally in under 40 ms for staged files, and providing a simple 1‑click hook installer.

工作流

• Install Secret‑Scrub via npx: npx secret-scrub install-hook to add a pre‑commit hook.
• Stage changes in Git as usual.
• Attempt to commit: the pre‑commit hook runs Secret‑Scrub on staged files.
• If a secret is detected, the hook aborts the commit and reports the offending string.
• If no secrets are found, the commit proceeds normally.
• Optionally run npx secret-scrub --staged manually for quick scans or npx secret-scrub . --format json for CI pipelines.

证据

Secret‑Scrub combines two complementary inspection layers: Vendor Signature Matching and Shannon Entropy Analysis.

来源

Scanning thousands of files on every commit slows down developers. Secret‑Scrub solves this with --staged mode… takes less than 40 milliseconds.

来源

npx secret-scrub install-hook automatically configures .git/hooks/pre-commit.

来源