tanmayshahane/kyubisweepA lightweight, cross-platform CLI tool that scans your filesystem to detect exposed secrets, API keys, and tokens. Built with Go for maximum performance and zero dependencies.
Hunt exposed secrets with the cunning of a fox!
A lightweight, cross-platform CLI tool that scans your filesystem to detect exposed secrets, API keys, and tokens. Built with Go for maximum performance and zero dependencies.
# macOS Apple Silicon (M1/M2/M3)
curl -L -o kyubisweep https://github.com/tanmayshahane/kyubisweep/releases/latest/kyubisweep-darwin-arm64
chmod +x kyubisweep
# Run it!
./kyubisweep --path /path/to/your/project
# Ensure Go 1.21+ is installed
go version
# Clone and build
git clone https://github.com/tanmayshahane/kyubisweep.git
cd kyubisweep
go build -o kyubisweep ./cmd/sweep/main.go
# Run it!
./kyubisweep --path .
USAGE:
kyubisweep [OPTIONS]
OPTIONS:
--path <directory> Path to scan (default: current directory)
--verbose Enable detailed output
--all Show all severity levels (default: HIGH only)
--all-files Scan all files, not just text-based files
--ext <extensions> Additional extensions to scan (comma-separated)
--json Output report as JSON file
--no-report Don't save report file
--quiet Minimal output, just summary
--move-to <path> Move files with secrets to quarantine directory
--help Show this help message
EXAMPLES:
kyubisweep --path ./my-project
kyubisweep --path . --all # Show all severities
kyubisweep --path . --ext log,dat # Add custom extensions
kyubisweep --path . --move-to ./vault # Quarantine sensitive files
kyubisweep --path . --json # Export as JSON
╔══════════════════════════════════════════════════════════════════════════╗
║ 🛡️ KYUBISWEEP SECURITY HYGIENE SCORECARD ║
╚══════════════════════════════════════════════════════════════════════════╝
🚨 CRITICAL ISSUES FOUND
📊 RISK BREAKDOWN
─────────────────────────────────────────
🚨 CRITICAL 9 ████████████████░░░░
🔴 HIGH 2 ███░░░░░░░░░░░░░░░░░
🟡 MEDIUM 0 ░░░░░░░░░░░░░░░░░░░░
🔵 LOW 0 ░░░░░░░░░░░░░░░░░░░░
🔍 FINDINGS DETAIL
─────────────────────────────────────────
RISK TYPE LOCATION
[CRITICAL] AWS Access Key ID ~/project/.env:5
[CRITICAL] PostgreSQL Connection ~/project/config.yaml:12
[HIGH] Stripe Secret Key ~/project/payment.js:42
📁 Scanned: ~/my-project
📄 Files analyzed: 2.9K
⏱️ Duration: 1.2s
graph TD
subgraph "Initialization (Main Goroutine)"
A[Start CLI] --> B{Parse Flags};
B -->|--path| C[Init Walker];
B -->|--move-to| D[Init Quarantine Mgr];
C --> E[Create Jobs Channel];
E --> F[Create Results Channel];
end
subgraph "Producer (Goroutine 1)"
G[Walker] -->|Finds Files| E;
style G fill:#f9f,stroke:#333,stroke-width:2px
style E fill:#ccf,stroke:#333,stroke-width:2px,stroke-dasharray: 5 5
end
subgraph "Worker Pool (Goroutines 2...N)"
E -->|Read File Path| H[Worker 1];
E -->|Read File Path| I[Worker 2];
E -->|Read File Path| J[Worker N];
H -->|Read Content| K{Analyzer};
I -->|Read Content| K{Analyzer};
J -->|Read Content| K{Analyzer};
K -- No Secret --> L((Discard));
K -- Secret Found --> M[Send Finding];
M --> F;
style K fill:#ff9,stroke:#333,stroke-width:2px
end
subgraph "Consumer & Wrap up (Main Goroutine)"
F -->|Collect Findings| N[Reporter / Table UI];
style F fill:#ccf,stroke:#333,stroke-width:2px,stroke-dasharray: 5 5
N --> O{Quarantine Requested?};
O -- Yes --> P[Move Files to Vault];
O -- No --> Q[Exit];
P --> Q;
end
%% Add a WaitGroup visual helper
H -.-> WG[sync.WaitGroup];
I -.-> WG;
J -.-> WG;
WG -.->|All Done| F;| Category | Examples |
|---|---|
| Cloud Credentials | AWS Access Keys, Google API Keys, Azure tokens |
| Payment Systems | Stripe API keys (live & test) |
| Developer Tools | GitHub PATs, NPM tokens, Heroku API keys |
| Communication | Slack tokens, Discord bot tokens, Twilio keys |
| Databases | PostgreSQL, MongoDB, MySQL connection strings |
| Cryptographic | RSA/SSH/PGP private keys |
| Generic | Passwords, API keys, Bearer tokens |
kyubisweep/
├── cmd/
│ └── sweep/
│ └── main.go # CLI entry point + worker pool
├── pkg/
│ ├── analyzer/
│ │ └── analyzer.go # Entropy + regex detection
│ ├── scanner/
│ │ └── walker.go # Concurrent directory walker
│ ├── reporter/
│ │ └── reporter.go # Security Scorecard output
│ ├── quarantine/
│ │ └── manager.go # Secure file relocation
│ └── common/
│ └── colors.go # Shared ANSI color utilities
├── reports/ # Generated scan reports
├── build/ # Cross-compiled binaries
├── go.mod # Go module definition
├── build.sh # Cross-platform build script
└── README.md
# Make the build script executable
chmod +x build.sh
# Build for all platforms
./build.sh
# Outputs:
# build/kyubisweep-darwin-arm64 (macOS Apple Silicon)
# build/kyubisweep-darwin-amd64 (macOS Intel)
# build/kyubisweep-linux-amd64 (Linux 64-bit)
# build/kyubisweep-linux-arm64 (Linux ARM)
# build/kyubisweep-windows-amd64.exe (Windows 64-bit)
Found secrets you need to secure immediately? Use --move-to to relocate files:
./kyubisweep --path . --move-to ./secure_vault
Safety features:
Contributions are welcome! Please feel free to submit a Pull Request.
MIT License - feel free to use this in your own projects!
Made with 🦊 by developers who accidentally committed their API keys one too many times.