ntoskernel/deepsecretsOffline secrets scanner combining regex rules, lexer-based semantic analysis, and hashed-value matching to detect exposed credentials in code with SARIF output.
Absolutely not!
In our LLM-hype era, DeepSecrets still runs entirely on your machine — giving you great results offline, securely, and for free.
Most existing scanners don't actually "understand" code. Instead, they just parse texts and have bad coverage.
DeepSecrets bridges the gap between classic regex scanners and full-scale commercial SAST tools. It extends the classic regex-based scanning strategy by heavily relying on semantic code analysis, dangerous variable detection, and context-aware entropy analysis. This means secret candidates are always semantically correct. We achieve true code understanding across 500+ languages and formats using lexing and parsing techniques.
DeepSecrets also introduces a new way to find credentials with zero knowledge: the HashedSecret Engine. Just provide the hashed values of your known production secrets, and the tool will find them exposed in plain text within your code.
DeepSecrets v2.0 was evaluated (June 2026) against the SecretBench benchmark outperforming traditional flat-text scanners:
(You can read the full under-the-hood story and benchmark breakdown in my HackerNoon article here)
From Github via pip
$ pip install git+https://github.com/ntoskernel/deepsecrets.git
From PyPi
$ pip install deepsecrets
DeepSecrets needs Python 3.11 or later.
The easiest way to run a scan:
$ deepsecrets --target-dir /path/to/your/code --outformat dojo-sarif --outfile report.json
This will run a scan against /path/to/your/code using the default configuration:
A report in SARIF format (compatible with DefectDojo and GitHub Security) will be saved to report.json.
The --help command is always ready to guide you, but here are the key flags you can use to tailor the scan to your environment:
--regex-rules /path/to/rules.json: Supply your own custom regex ruleset.--hashed-values /path/to/hashes.json: Provide a list of pre-hashed known production secrets to search for them securely.--excluded-paths /path/to/exclusions.json: Override or extend the default paths ignored during scanning.--deep-max-size BYTES: Files larger than this (default 250,000 bytes) get the fast analysis: the regex rules and the variable search, without the language lexer. Big files are mostly generated or minified, the lexer costs most of the scan time on them and rarely finds more there. 0 gives every file the full analysis.--skip-bundles: Skip minified JavaScript, source maps and bundles (*.min.js, *.map, *.bundle.js) entirely, on top of the other path exclusions.--confidence-level {all,low,medium,high,very-high}: The lowest confidence to report (default low, every finding). medium, high and very-high keep confidence 3, 6 and 9 or more; all also reports the regex matches the scanner judged not to be secrets (placeholders, examples), with an -INFO rule id.--report-diagnostics: Add every file found under the target to the SARIF report, with its status, scan time, skip reason and analysis depth.--regex-candidate-scoring-rules /path/to/rules.json: Supply your own rules for judging regex matches before they are reported. Give the flag no value to report regex matches unjudged.--multiprocessing-context {forkserver,spawn,fork}: How worker processes start. The default is forkserver where the platform has it (Linux, macOS): workers share the scanner already loaded in a server process. Windows uses spawn. All three give the same findings.--disable-masking: Keep potential secrets unmasked in the output report (see caution below).--ci / --no-ci: Turn CI mode on or off. CI mode prints a plain progress line every 30 seconds instead of the live progress display. It turns on by itself inside CI services (GitHub Actions, GitLab CI, Jenkins and others) and whenever the output is not a terminal.eq. .github/workflows/deepsecrets.yml
name: DeepSecrets Scan
on: [push, pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Install DeepSecrets
run: pip install deepsecrets
- name: Run Scan
run: deepsecrets --target-dir . --outformat dojo-sarif --outfile report.sarif
continue-on-error: true
- name: Upload SARIF report
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: report.sarif
As of v1.3.0, potential secrets are automatically masked inside reports to protect your pipeline artifacts. Turn this off via the --disable-masking flag if necessary.
Masking doesn't break the deduplication logic of downstream platforms (like Github), as the partialFingerprints section in the report is correctly populated based on the raw data.
[!Caution]
If you integrate DeepSecrets into your CI pipeline with masking disabled, you will likely re-leak your secrets inside your CI logs and artifacts.
Every finding gets a confidence score. However, different security platforms parse SARIF metrics differently. To ensure compatibility across modern ASPM dashboards, DeepSecrets does the following:
Virtual Subrules (rules[]): Dynamically generates rules by confidence tier, from S105-LOW through -MEDIUM and -HIGH to S105-VERY-HIGH (and -INFO for the rejected matches --confidence-level all reports). This forces GitHub Security and DefectDojo to map semantic precision variance properly without breaking native parsers.
Deterministic Result Level: The tool always explicitly sets level: error in the results[] model. This acts as a universal fallback for CI/CD pipelines and older SAST parsers, ensuring that exposed secrets reliably break builds or block Pull Requests regardless of individual rule interpretations.
Contextual Messages: Injects the raw numeric confidence score natively into result.message.text so security analysts see it immediately on their dashboards.
The built-in ruleset for regex checks is located in /deepsecrets/rules/regexes.json. You're free to follow the format and create a custom ruleset.
Example ruleset for hashed checks is located in /tests/fixtures/hashed_secrets.json. You're free to follow the format and create a custom ruleset.
To look for known production secrets without exposing them in plaintext inside your repository, provide a JSON containing their hashes:
[
{
"name": "KNOWN-PROD-DATABASE-PASSWORD",
"hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"length": 12,
"algorithm": "sha1"
}
]
Run with --hashed-values /path/to/hashes.json. DeepSecrets will automatically hash string candidates on the fly during its lexing stage to match them.
Pff, is it still regex-based?