Credential Scanner

Detect leaked Access Keys and Secret Keys in your codebase.

---

🌐 Links

• 🔑 About Access Keys: Outscale Access Keys
• ⚙️ GitHub Action: action.yml
• 🧪 Test Script: tests/tests.sh
• 🤝 Contribution Guide: CONTRIBUTING.md
• 💬 Join us on Discord

---

📄 Table of Contents

• Overview
• Features
• Requirements
• Usage
• GitHub Actions Integration
• Contributing
• License

---

🧭 Overview

Credential Scanner is a lightweight Bash script that recursively scans a directory for leaked Outscale Access Keys and Secret Keys.

It skips binary files and uses strict patterns to avoid false positives and catch high-confidence secrets.

---

✨ Features

• Recursive scanning of directories

• Skips binary files

• Detects:

  • Access Keys (20-character uppercase alphanumeric)
  • Secret Keys (40-character uppercase alphanumeric)

• Ignores known test keys:

  • ABCDEFGHIJ0123456789
  • 0123456789ABCDEFGHIJ

• Ignores weak matches:

  • Access Keys with <3 digits or <3 uppercase letters
  • Secret Keys with <5 digits or <5 uppercase letters

---

✅ Requirements

• Bash shell (Linux/macOS/WSL)
• grep, find, and standard POSIX utilities

---

🚀 Usage

./scan.sh /path/to/your/codebase

Example:

./scan.sh ./src/

---

🧪 GitHub Actions Integration

You can integrate this scanner directly into your GitHub workflows to detect secrets on pull requests.

📥 Inputs

Input	Description	Required	Default
scan_path	Path to scan	✅ Yes	"./"

📤 Outputs

None

🧾 Example Workflow

Create a file at .github/workflows/cred-scan.yml:

name: Credential Scanner

on:
  pull_request:
    branches: [ main ]

permissions:
  contents: read

jobs:
  cred-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Scan credentials
        uses: outscale/cred-scan@main
        with:
          scan_path: "./"

---

🤝 Contributing

We welcome contributions and discussions!

• Run tests with:

  ./tests/tests.sh

Please read our Contributing Guidelines and Code of Conduct before submitting a pull request.

---

📜 License

Credential Scanner is licensed under the BSD 3-Clause License. © Outscale SAS

This project follows the REUSE Specification.