Secrets Scanner TUI

Interactive terminal scanner for detecting potential secrets in project files.

Features

• scans text-based project files for potential secrets
• interactive TUI built with curses
• color-coded Findings list
• Details panel with surrounding context
• help window with keyboard shortcuts
• baseline support for accepted findings
• JSON and CSV report export
• CI mode for automated checks
• directory and file-pattern exclusions

What it detects

The scanner looks for patterns such as:

• password assignments
• AWS access keys
• AWS secret keys
• private keys
• bearer tokens
• JWTs
• connection strings
• high-entropy hexadecimal strings

Screenshots

Example command

Welcome window

Scan progress

Main view

Help window

Details modal

Requirements

• Python 3.9+
• terminal with curses support

Quick start

Scan a project:

python scan_secrets.py /path/to/project

Run in CI mode:

python scan_secrets.py /path/to/project --ci

Exclude additional directories:

python scan_secrets.py /path/to/project --exclude cache --exclude tmp

Exclude additional files or glob patterns:

python scan_secrets.py /path/to/project --exclude-file jquery.js --exclude-file "*.min.js"

Default exclusions

The script already ignores common folders such as:

• .git
• node_modules
• vendor
• dist
• build

It also includes a built-in list of ignored files and paths, for example:

• jquery.js
• jquery.min.js
• jquery-1.6.3.min.js
• admin/_js/tiny_mce/*
• public/js/vendor/*

Reports

After scanning, the tool writes:

• report.json — full report with context
• report.csv — flat CSV report

You can override output paths:

python scan_secrets.py /path/to/project --report-json out/report.json --report-csv out/report.csv

Baseline workflow

Accepted findings can be stored in a baseline file.

Default baseline path:

.secrets-baseline.json

Custom baseline path:

python scan_secrets.py /path/to/project --baseline custom-baseline.json

Use the TUI to mark entries as accepted, then save the baseline with:

• w — save baseline

TUI keyboard shortcuts

Navigation

• ↑ / ↓ / PgUp / PgDn — move through findings
• ← / → — horizontal scroll in details
• Enter — open details modal
• h — open help / about
• q / Esc — quit app or close modal

Finding decisions

• a — mark as accepted
• r — mark as rejected
• s — mark as skipped
• u — reset to pending

Filters

• f — cycle status filter
• t — cycle secret type filter
• / — filter by file path
• c — clear filters

Other

• w — save baseline

CI mode

In CI mode the scanner exits with:

• 0 when no new secrets are found
• 2 when new secrets are found
• 1 on input/path errors

Example:

python scan_secrets.py /path/to/project --ci --baseline .secrets-baseline.json

Typical workflow

1. Run a scan locally.
2. Review findings in the TUI.
3. Mark known false positives as accepted.
4. Save the baseline.
5. Use --ci in your pipeline to detect new secrets.

Project structure

scan_secrets.py
report.json
report.csv
.secrets-baseline.json

Limitations

• detection is pattern-based, so false positives are possible
• some secrets may still require manual review
• curses behavior depends on terminal support and platform

License

MIT