segrep-secrets scanner

Opt-in native secret detection scanner for Segrep that uses regex pattern matching to find hardcoded credentials, API keys, tokens, and connection strings — no external binary required.

Why use segrep-secrets

• Detects 28 categories of secrets including AWS keys, GitHub tokens, Slack tokens, Stripe keys, private keys, and generic credential patterns.
• Runs locally with zero dependencies — no Gitleaks binary or Docker required.
• Scans .env, source code, config files, and key/cert files across all common languages.
• Excludes lockfiles, minified files, and common non-secret directories (node_modules, dist, .git).
• Every finding is critical or high severity with CWE references for compliance tracking.

Scanner behavior

segrep-secrets runs as an opt-in scanner.

pnpm segrep scan . --scanners segrep-secrets

It walks the scan root and applies regex rules line-by-line to detect secrets.

Secret rules

Finding output

Each finding includes:

• ruleId — the matched rule (e.g., aws-access-key)
• cweId — CWE reference (e.g., CWE-798 for hardcoded credentials)
• line — line number where the secret was found
• snippet — the matched line (truncated to 200 chars)

Example finding:

{
  "id": "segrep-secrets:github-pat:config.js:3",
  "title": "GitHub Personal Access Token detected (config.js:3)",
  "severity": "critical",
  "filePath": "config.js",
  "scanner": "segrep-secrets",
  "category": "secret",
  "ruleId": "github-pat",
  "cweId": "CWE-798",
  "line": 3,
  "snippet": "github_token: \"ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef1234\","
}

File coverage

Scanned extensions

.ts, .tsx, .js, .jsx, .mjs, .cjs, .go, .py, .rb, .java, .kt, .scala, .rs, .c, .cpp, .h, .hpp, .sh, .bash, .zsh, .fish, .env, .yml, .yaml, .toml, .ini, .cfg, .conf, .xml, .json, .properties, .config, .dockerfile, .tf, .hcl, .pem, .key, .crt, .cer, .sql, .graphql, .gql

Also scans extensionless files named Dockerfile, Makefile, or Rakefile.

Excluded directories

.git, node_modules, dist, build, .next, .nuxt, coverage, .nyc_output, vendor, .tox, __pycache__, .cache, .parcel-cache, tmp, .segrep

Skipped files

Lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, go.sum, Cargo.lock, Gemfile.lock, poetry.lock, composer.lock, Pipfile.lock) and minified files (*.min.js, *.min.css).

Relationship to gitleaks

• gitleaks scanner: external binary with git history analysis and rule templating
• segrep-secrets scanner: native regex-based scanner for the working tree, no external dependencies

Use both for maximum coverage, or segrep-secrets alone for fast CI scans without binary installation.

Policy integration

scanners:
  - segrep-secrets

# Allowlist known-good findings by rule ID
allowlist:
  - google-oauth-client-id

# Ignore test fixtures
ignore_paths:
  - "fixtures/**"
  - "**/*.test.*"

Examples

Secrets only:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-secrets

Combine with dependency scanning:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-vuln,segrep-secrets --format json

Fail CI on any secret detection:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-secrets --fail-on critical

Related docs

• Product scan guide
• Docker image reference
• Add a scanner