m14r41/scan4secretsFind credentials and secret with 170+ rules covering across source code, Web URL, and CI/CD, verifies them against vendor APIs, and generates SARIF, JSONL, HTML, PDF, or Excel reports.
DAST + SAST secret scanner with live verification, source-map parsing, and CI-native reporting plus a SAST vulnerability & misconfiguration engine.
Find leaked credentials in source trees, running web apps, and CI logs. Verify them live against vendor APIs. Scan the same source trees for code vulnerabilities and misconfigurations. Output SARIF for code-scanning dashboards, JSONL for SOAR pipelines, or Excel/PDF/HTML for client reports.
The crowded landscape (gitleaks, trufflehog, detect-secrets) is great at SAST on git trees but stops there — and they scan for secrets only. scan4secrets fills the gaps they don't cover, adding live web DAST, live vendor verification, and a code-vulnerability / misconfiguration engine on top of secret detection:
| Capability | gitleaks | trufflehog | detect-secrets | scan4secrets |
|---|---|---|---|---|
| SAST secret detection | Y | Y | Y | Y |
| DAST live web crawl | - | - | - | Y |
| JS source-map parsing | - | - | - | Y |
| JS endpoint extraction | - | - | - | Y |
| HTTP-header secret scan | - | - | - | Y |
| Live token verification | - | Y | - | Y |
| SARIF output | Y | - | - | Y |
| Excel / PDF / HTML reports | - | - | - | Y |
| Entropy gate + allowlist | Y | Y | Y | Y |
| YAML rules schema | - (TOML) | - | - | Y |
| Authenticated DAST (cookie/header/proxy) | n/a | n/a | n/a | Y |
| SAST vulnerability / misconfiguration detection | - | - | - | Y |
It is a complement to gitleaks, not a replacement. Use both: gitleaks in pre-commit + CI for git-history SAST, scan4secrets for live DAST against staging/production.
# from source
git clone https://github.com/m14r41/scan4secrets
cd scan4secrets
pip install -e .
# OR via pipx
pipx install git+https://github.com/m14r41/scan4secrets
# OR Docker
docker run --rm -v $(pwd):/scan ghcr.io/m14r41/scan4secrets:latest --path /scan
After install, the scan4secrets command is on your PATH.
# SAST: scan a local directory
scan4secrets --path /code
# DAST: crawl a live target
scan4secrets --url https://staging.example.com --threads 32
# DAST runs ALL bundled wordlists by default (1279 paths: /.env, /wp-config.php, /backup.zip, ...)
scan4secrets --url https://target.com
# Use YOUR OWN wordlist file (replaces the bundled set)
scan4secrets --url https://target.com --wordlist /path/to/my-paths.txt
# Combine multiple custom wordlist files
scan4secrets --url https://target.com --wordlist seclists/Common.txt internal-paths.txt
# Restrict to specific bundled wordlists by stem
scan4secrets --url https://wp.example.com --wordlist-only wordpress common env
# Turn wordlist seeding off entirely (only follow live links)
scan4secrets --url https://target.com --no-wordlist
# Full audit with verification + HTML report
scan4secrets --path . --url https://app.example.com \
--verify --report html sarif json \
--output reports/audit-$(date +%F)
# Authenticated DAST with proxy (works with Burp / ZAP)
scan4secrets --url https://app.example.com \
--cookie "session=abc123" \
--header "X-Tenant: acme" \
--proxy http://127.0.0.1:8080
# CI gate (exit 1 if anything >= high)
scan4secrets --path . --report sarif --fail-on high \
--output reports/scan
# SAST: secrets + code vulnerabilities / misconfigurations
scan4secrets --path ./src --misconfig
# SAST: vulnerabilities / misconfigurations only (skip secret detection)
scan4secrets --path ./src --misconfig-only
--misconfig)Beyond secrets, scan4secrets ships a SAST engine for code vulnerabilities and misconfigurations. Add --misconfig to scan for both secrets and vulnerabilities, or --misconfig-only to scan for vulnerabilities alone:
scan4secrets --path ./src --misconfig # secrets + vulnerabilities
scan4secrets --path ./src --misconfig-only # vulnerabilities only
scan4secrets --path . --misconfig --report html --output report
It detects — with taint/context gating to keep false positives low — SQL injection, NoSQL injection, OS command injection, code injection (eval), SSTI, XXE, insecure deserialization, LFI / path traversal, LDAP & XPath injection, SSRF, open redirect, CORS misconfig, CSRF-disabled, prototype pollution, XSS (reflected/stored/DOM across 11 templating engines: EJS, Handlebars, Pug, Jinja, Thymeleaf, Razor, Blade, ERB, Vue, Angular, React), weak crypto (DES/RC4/ECB/static-IV/weak-RSA), insecure randomness, JWT flaws (alg:none, algorithm confusion, hardcoded signing secret, verification disabled), TLS bypasses, timing-unsafe secret comparisons, SAML signature-not-required, hardcoded credentials, sensitive-data logging, and IaC/config misconfig (Terraform, Kubernetes, Dockerfile, GitHub Actions, ASP.NET web.config, WCF/SOAP).
Languages covered: python, node, javascript, typescript, react, php, ruby, go, java, kotlin, csharp/.NET, sql, plus XML/WSDL, JSP, Terraform/HCL, Kubernetes YAML, and Dockerfile.
Each vulnerability finding carries a rich record: Vulnerability Name, Severity, Description, Evidence (file:line), Vulnerable Code, Secure Code, Remediation, Technical Impact, Business Impact, and CWE + OWASP Top-10 mapping.
Beyond the line-by-line engine, a whole-file pass catches secrets that line-scanners miss: nested XML tags (<SMS_API_KEY><value>…</value></SMS_API_KEY>), split <key>/<value> pairs, JSON key/value objects, multi-line YAML/properties, and Base64-encoded secrets. It also closes an entropy-gate blind spot — credential-named assignments (e.g. AM_CLIENT_SECRET=…) are flagged on the name signal with no entropy floor, so real low-entropy secrets are no longer silently dropped.
416 rules total — 193 secret rules + 223 vulnerability / misconfiguration rules.
Secret rules cover: