Your secrets shouldn't end up in your terminal, your logs, or your commit history.
Install · Demo · Try it · Homepage 🌐 · Full usage guide →
You've done this. Everyone has: a stray print() left in from
debugging, a log line that dumps a config dict, a hardcoded key that
slips past review. SecretShield catches it before it leaves your
machine — redacted from your terminal output automatically, scanned
out of your codebase on demand, and blocked from your commits if it
gets that far.
▶ Watch the full demo on YouTube
Windows (recommended): download secretshield-windows-x64-setup.exe from the
latest release, run it, then open a
new terminal and try:
ss --version
ss scan .No Python needed, no administrator rights. A portable zip is also available, and Linux and macOS get a single-file binary. The builds are not code-signed, so Windows or macOS may show a warning: see the installation guide for checksums, upgrading, uninstalling and troubleshooting.
Python developers:
pip install secretshieldimport secretshield
api_key = "sk-example1234567890abcdefFAKEKEY"
print("API key:", api_key)API key: ********
⚠ secretshield: Potential secret detected and redacted.
No config, no code changes — the moment you import it, stdout, stderr,
and logging are protected.
Scan a project:
secretshield scan .Set a project up in one step — config file, Git hook, CI workflow:
secretshield init(Every command also works via the shorter ss alias.)
| 🖥️ Runtime protection | import secretshield redacts secrets from stdout, stderr, and logging automatically |
| 🔍 Static scanning | secretshield scan . finds hardcoded secrets across Python, JS/TS, HTML, YAML, .env, and more |
| 🔧 Auto-Fix | scan . --fix moves a hardcoded Python or JS/TS secret into .env and rewrites the code — only when it's unambiguous |
| 🔄 Rotation assistant | scan . --rotate walks you through revoking a leaked credential with its provider, replacing it, and checking for leftover copies — it never revokes anything itself |
| 🪝 Git hook | install-hook blocks a commit before a secret reaches your history |
| ⚙️ GitHub Actions | github-action generates a workflow that scans every push and PR |
No required dependencies, no telemetry, no network calls. Everything runs locally, in your own process.
Have a credential format of your own? Drop a
.secretshield-rules.toml in your project root:
[[rules]]
name = "My API Key"
pattern = "MYAPP_[A-Za-z0-9]{32}"secretshield scan . picks it up automatically — no flag needed. The
rules file itself is never treated as project content to scan, so a
pattern that resembles a real secret won't flag its own definition.
Validate rules with secretshield rules check, create one
interactively with secretshield rule create, or try a pattern against
sample text with secretshield rule test before committing to it.
For the full command reference, configuration options, and exactly how Auto-Fix decides what's safe to rewrite, see the usage guide.
Runtime protection covers this Python process's stdout/stderr/
logging — not screenshots, the clipboard, or other applications.
Auto-Fix only rewrites Python and JS/TS, and only unambiguous
assignments; anything less certain is reported, not modified. Treat
SecretShield as a strong safety net, not a replacement for proper
secret management. Details in the usage guide.
Issues and PRs welcome. Add tests for new detection patterns or
behavior changes, use only fake credentials in tests/examples, and run
pytest before opening a PR.
☕ Get me a coffee
If you find this project useful, consider supporting its development through GitHub Sponsors.
MIT — see LICENSE.
Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
SecretShield was recognised as Best Developer Tool in Waycode's Founding 100.
Waycode's Founding 100 brought together builders and their projects, recognising eight projects across different categories.
This recognition highlights SecretShield's work in open-source security tooling and local-first secret detection.