Metadata-Version: 2.4
Name: plainkitbin-secret-scan-cli
Version: 1.0.0
Summary: Scan a local directory for likely leaked credentials, offline, stdlib only.
Author: PlainKitBin
License: MIT
Project-URL: Homepage, https://plainkitbin.com
Project-URL: Source, https://github.com/plainkitbin
Keywords: security,secrets,cli,offline,developer-tools
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# Secret Scan CLI

Scan a local directory for likely leaked credentials (AWS keys, GitHub
tokens, Slack tokens, private keys, generic `api_key=` assignments) --
offline, no dependencies. Python 3.8+, stdlib only (`re`, `os`,
`argparse`). No network at runtime.

## Install

```bash
pip install plainkitbin-secret-scan-cli
```

## Usage

```bash
secret-scan-cli .
secret-scan-cli path/to/repo
```

Exits with code `1` if any finding is present, `0` otherwise (suitable
for a pre-commit hook or CI check). Matches are redacted in the output
(only the first/last 4 characters are shown).

## What it detects

Fixed regex patterns for: AWS access keys, GitHub personal access
tokens (`ghp_...`), Slack tokens (`xox...`), PEM-style private key
blocks, and a generic `api_key = "..."` pattern.

## Limitations

Pattern-based only -- no entropy analysis, no support for credential
formats outside the five patterns above, and no historical git-log
scanning (working tree only). This will miss credentials that do not
match a known shape. It is a lightweight local check, not a substitute
for a dedicated credential-scanning service.

Free and open source (MIT license, see LICENSE). No telemetry, no network calls, no nagware.

Part of the PlainKitBin toolset.

Provided as-is with no individual support.

---
*Built with AI assistance and automatically tested before release; released under human oversight.*
