Secrets Scanner

https://github.com/whit3rabbit/secrets-scanner
Admin
Secrets Scanner is a high-performance Rust library and CLI for detecting leaked secrets in source...
Tokens:168,650
Snippets:1,964
Trust Score:9.1
License:MIT
Update:4 months ago
Show doc for...
Tokens:
Raw
### Install Agent Skill

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/CLAUDE.md

Install the bundled agent skill into a runtime. Optionally use `--local [PATH]` to target a repository or `--dry-run` to simulate installation.

```rust
cargo run -- install-skill --agent <id> [--local [PATH]] [--dry-run]
```

--------------------------------

### Install and Run MCP Server

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node-mcp/README.md

Use npx to install and run the MCP server for secrets-scanner, specifying the root directory for scanning.

```bash
npx -y @whit3rabbit/rsecrets-scanner-mcp --root /path/to/project
```

--------------------------------

### Install Secrets Scanner Skill with OpenClaw from Local Checkout

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/README.md

Install the skill directory from a local checkout using OpenClaw.

```bash
openclaw skills install ./plugins/secrets-scanner/skills/secrets-scanner
```

--------------------------------

### MCP Client Configuration Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node-mcp/README.md

Example JSON configuration for an MCP client to connect to the rsecrets-scanner-mcp server.

```json
{
  "mcpServers": {
    "rsecrets": {
      "command": "npx",
      "args": [
        "-y",
        "@whit3rabbit/rsecrets-scanner-mcp",
        "--root",
        "/path/to/project"
      ]
    }
  }
}
```

--------------------------------

### Install secrets-scanner via one-liner script

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Installs the secrets-scanner CLI using a curl command to download and execute an installation script.

```bash
curl -fsSL https://raw.githubusercontent.com/whit3rabbit/secrets-scanner/main/install.sh | bash
```

--------------------------------

### Perplexity API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a Perplexity API key. The regex targets keys starting with 'pplx-' followed by 48 alphanumeric characters.

```regex
\b(pplx-[A-Za-z0-9]{48})\b
```

--------------------------------

### Install secrets-scanner via Homebrew

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Installs the secrets-scanner CLI on macOS or Linux using Homebrew.

```bash
brew install --cask whit3rabbit/tap/secrets-scanner
```

--------------------------------

### Neon Connection URI Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a Neon PostgreSQL connection URI. The regex targets URIs pointing to '.neon.tech' domains and includes credentials.

```regex
(?i)\bpostgres(?:ql)?://[^\s:/?#]+:[^\s@/]+@[^\s]*\.neon\.tech[^\s]*
```

--------------------------------

### Artifactory API Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Artifactory API key. This rule is active and uses a regex to detect keys starting with 'AKCp' followed by 69 alphanumeric characters.

```regex
\bAKCp[A-Za-z0-9]{69}\b
```

--------------------------------

### Install Secrets Scanner on Windows

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Installs the secrets-scanner using a PowerShell command to download and execute an installation script.

```powershell
irm https://raw.githubusercontent.com/whit3rabbit/secrets-scanner/main/install.ps1 | iex
```

--------------------------------

### 1Password Service Account Token Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of a 1Password service account token. This rule is active and uses a regex to identify tokens starting with 'ops_'.

```regex
ops_eyJ[a-zA-Z0-9+/]{250,}={0,3}
```

--------------------------------

### Install Secrets Scanner Skill with Hermes

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/README.md

Install a single skill from a GitHub repository path using Hermes.

```bash
hermes skills install whit3rabbit/secrets-scanner/plugins/secrets-scanner/skills/secrets-scanner
```

--------------------------------

### Install Browser/Edge WASM Binding

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Install the WebAssembly binding package for secrets-scanner for browser and Edge environments.

```bash
npm install @whit3rabbit/rsecrets-scanner-wasm
```

--------------------------------

### GitHub Action Workflow Configuration

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Example of a GitHub Actions workflow file (.github/workflows/secrets.yml) demonstrating how to use the whit3rabbit/secrets-scanner action. It includes permissions, job setup, checkout, action usage, and SARIF upload.

```yaml
# .github/workflows/secrets.yml
permissions:
  contents: read
  security-events: write   # required for the SARIF upload

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0    # full history for `git-tracked`, `base`, or history scans

      - id: scan
        uses: whit3rabbit/secrets-scanner@v0.1.0   # pin a released tag
        with:
          fail-on-findings: false   # gate via SARIF instead of failing the job

      - name: Upload SARIF
        if: always() && steps.scan.outputs.sarif-file != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif-file }}
```

--------------------------------

### Manually Install Secrets Scanner

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Download the pre-built binary from GitHub Releases, move it to a directory in your PATH, and make it executable.

```bash
chmod +x /usr/local/bin/secrets-scanner
```

--------------------------------

### Install Secrets Scanner via Homebrew Tap

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Add the secrets-scanner Homebrew tap and then install the formula or the recommended cask version.

```bash
brew tap whit3rabbit/tap
```

```bash
brew install secrets-scanner
```

```bash
brew install --cask whit3rabbit/tap/secrets-scanner
```

--------------------------------

### Install Hermes and OpenClaw Skills

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Installs the secrets-scanner skill directly into Hermes and OpenClaw agent runtimes from a local repository checkout.

```bash
hermes skills install whit3rabbit/secrets-scanner/plugins/secrets-scanner/skills/secrets-scanner
openclaw skills install ./plugins/secrets-scanner/skills/secrets-scanner
```

--------------------------------

### Verify secrets-scanner installation

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Verifies the secrets-scanner installation by checking its version.

```bash
secrets-scanner --version
```

--------------------------------

### Clipdrop API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a Clipdrop API key. The regex is case-insensitive and looks for keys starting with 'clipdrop' followed by a specific character set and length.

```regex
(?i)\b(?:clipdrop)\b[^\r\n]{0,80}?\b([A-Za-z0-9_-]{24,128})\b
```

--------------------------------

### Install Secrets Scanner on macOS/Linux

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Use this curl command to download and execute the automated installation script for macOS and Linux. You can specify a VERSION to install a specific release.

```bash
curl -fsSL https://raw.githubusercontent.com/whit3rabbit/secrets-scanner/main/install.sh | bash
```

```bash
curl -fsSL https://raw.githubusercontent.com/whit3rabbit/secrets-scanner/main/install.sh | VERSION=0.1.0 bash
```

--------------------------------

### Brave Search API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a Brave Search API key. The regex targets keys starting with 'BSA' followed by a specific range of alphanumeric characters and hyphens.

```regex
\b(BSA[A-Za-z0-9_-]{24,40})\b
```

--------------------------------

### Install secrets-scanner via Cargo

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Installs the secrets-scanner CLI using Cargo, the Rust package manager.

```bash
cargo install secrets_scanner
```

--------------------------------

### Install secrets-scanner Node.js Package

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node/README.md

Install the @whit3rabbit/rsecrets-scanner package using npm. This command installs the prebuilt native addon for your platform.

```bash
npm install @whit3rabbit/rsecrets-scanner
```

--------------------------------

### Install Secrets Scanner on Windows

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Use this PowerShell command to download and execute the automated installation script for Windows. You can specify a VERSION using the $env:VERSION variable.

```powershell
irm https://raw.githubusercontent.com/whit3rabbit/secrets-scanner/main/install.ps1 | iex
```

```powershell
$env:VERSION="0.1.0"; irm https://raw.githubusercontent.com/whit3rabbit/secrets-scanner/main/install.ps1 | iex
```

--------------------------------

### Snowflake PostgreSQL Host and Password Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a Snowflake PostgreSQL host and password combination. The regex captures hostnames ending in '.snowflakecomputing.com' with a port and a password-like string.

```regex
(?i)\b([A-Za-z0-9.-]+\.snowflakecomputing\.com:[A-Za-z0-9._~:/+=-]{16,160})\b
```

--------------------------------

### Kingfisher AI71 API Key Rule Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects AI71 API keys, which start with 'ai71-api-' followed by a UUID.

```regex
(?xi)
\b
(
  ai71-api-
  [a-f0-9]{8}-
  [a-f0-9]{4}-
  [a-f0-9]{4}-
  [a-f0-9]{4}-
  [a-f0-9]{12}
)
\b

```

--------------------------------

### Install Secrets Scanner Skill

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Installs the secrets-scanner agent skill into the user's home directory or a specific project. Supports repeatable installations and agent selection.

```bash
# Install into your user home (default scope), repeatable --agent
secrets-scanner install-skill --agent claude --agent codex

# Install into a specific project instead of home
secrets-scanner install-skill --agent claude --local /path/to/repo

# Preview without writing anything
secrets-scanner install-skill --agent claude --dry-run

# Remove (only skills this tool owns)
secrets-scanner uninstall-skill --agent claude
```

--------------------------------

### Install secrets-scanner CLI

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Installs the secrets-scanner CLI using a bundled bash script. This script attempts to use Homebrew, cargo, or downloads a prebuilt binary.

```bash
bash "$SKILL_DIR/scripts/install.sh"
```

--------------------------------

### Install Secrets Scanner with Cargo

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Install secrets-scanner using cargo-binstall for a quick pre-built binary installation, or build and install from crates.io. The --features updater flag enables runtime updater support.

```bash
cargo binstall secrets_scanner
```

```bash
cargo install secrets_scanner
```

```bash
cargo install secrets_scanner --features updater
```

--------------------------------

### MongoDB Atlas DB URI with Credentials Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a MongoDB Atlas database URI that includes credentials. The regex captures URIs starting with 'mongodb+srv://' or 'mongodb://' followed by username and password.

```regex
(?i)\bmongodb(?:\+srv)?://[^\s:/?#]+:[^\s@/]+@[^\s]+
```

--------------------------------

### Kingfisher Aikido CI Rule Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects Aikido CI keys starting with 'AIK_CI_' followed by 20 to 44 alphanumeric characters.

```regex
(?x)
\b
(
  AIK_CI_[A-Za-z0-9]{20,44}
)
\b

```

--------------------------------

### Kingfisher Adafruit IO Rule Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects Adafruit IO API keys starting with 'aio_' followed by specific character patterns.

```regex
(?x)
\b
(
  aio_
  [a-zA-Z]{4}
  [0-9]{2}
  [a-zA-Z0-9]{22}
)
\b

```

--------------------------------

### Install native pre-commit hook

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Installs a native git pre-commit hook that calls secrets-scanner to scan staged files before committing. Backs up existing hooks.

```bash
bash "$SKILL_DIR/scripts/install-git-hook.sh"
```

--------------------------------

### OpenRouter API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of an OpenRouter API key. The regex specifically matches the 'sk-or-v1-' prefix followed by 64 hexadecimal characters.

```regex
\b(sk-or-v1-[a-f0-9]{64})\b
```

--------------------------------

### OpenAI API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of an OpenAI API key. The regex covers different types of OpenAI keys, including project, service account, and admin keys, with specific prefixes and lengths.

```regex
\b(sk-(?:proj&#124;svcacct&#124;admin)-[A-Za-z0-9_-]{40,120}T3BlbkFJ[A-Za-z0-9_-]{40,120})\b&#124;\b(sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20})\b
```

--------------------------------

### 1Password Secret Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of a 1Password secret key. This rule is active and uses a specific regex for detection.

```regex
\bA3-[A-Z0-9]{6}-(?:(?:[A-Z0-9]{11})| (?:[A-Z0-9]{6}-[A-Z0-9]{5}))-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\b
```

--------------------------------

### Anthropic Admin API Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Anthropic admin API key. This rule is active and uses a regex to match the specific format of these keys.

```regex
\b(sk-ant-admin01-[a-zA-Z0-9_\-]{93}AA)(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### Algolia API Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Algolia API key. This rule is active and uses a regex to detect a 32-character alphanumeric key associated with 'algolia'.

```regex
(?i)[\w.-]{0,50}?(?:algolia)(?:[ \t\w.-]{0,20})[\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$) 
```

--------------------------------

### Anthropic API Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Anthropic API key. This rule is active and uses a regex to match the specific format of these keys.

```regex
\b(sk-ant-api03-[a-zA-Z0-9_\-]{93}AA)(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### Asana Client ID Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Asana client ID. This rule is active and uses a regex to detect a 16-digit number associated with 'asana'.

```regex
(?i)[\w.-]{0,50}?(?:asana)(?:[ \t\w.-]{0,20})[\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([0-9]{16})(?:[\x60'"\s;]|\\[nr]|$) 
```

--------------------------------

### Adafruit API Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Adafruit API key. This rule is active and uses a regex that looks for 'adafruit' followed by a 32-character alphanumeric key.

```regex
(?i)[\w.-]{0,50}?(?:adafruit)(?:[ \t\w.-]{0,20})[\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9_-]{32})(?:[\x60'"\s;]|\\[nr]|$) 
```

--------------------------------

### Snowflake PostgreSQL Connection String Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a connection string for Snowflake PostgreSQL. The regex is case-insensitive and matches URIs for PostgreSQL or Snowflake pointing to Snowflake domains.

```regex
(?i)\b(?:postgres(?:ql)?&#124;snowflake)://[^\s:/?#]+:[^\s@/]+@[^\s]*snowflake[^\s]*
```

--------------------------------

### MCP server client configuration

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Example JSON configuration for an MCP client to connect to the secrets-scanner MCP server.

```json
{
  "mcpServers": {
    "rsecrets": {
      "command": "npx",
      "args": ["-y", "@whit3rabbit/rsecrets-scanner-mcp", "--root", "/path/to/project"]
    }
  }
}
```

--------------------------------

### DeepSeek API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a DeepSeek API key. The regex is case-insensitive and looks for common patterns associated with DeepSeek API keys.

```regex
(?i)\b(?:DEEPSEEK_API_KEY&#124;api\.deepseek\.com&#124;deepseek)\b[^\r\n]{0,80}?\b(sk-[A-Za-z0-9]{20,128})\b&#124;\b(sk-DeepSeek[A-Za-z0-9]{16,96})\b
```

--------------------------------

### Adobe Client ID Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Adobe client ID. This rule is active and uses a regex to detect a 32-character hexadecimal string associated with 'adobe'.

```regex
(?i)[\w.-]{0,50}?(?:adobe)(?:[ \t\w.-]{0,20})[\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-f0-9]{32})(?:[\x60'"\s;]|\\[nr]|$) 
```

--------------------------------

### Age Secret Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Age secret key. This rule is active and uses a regex to match the specific format of Age secret keys.

```regex
AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}
```

--------------------------------

### XAI API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of an XAI API key. The regex is case-insensitive and looks for common patterns associated with XAI API keys, including specific prefixes and character sets.

```regex
(?i)\b(?:XAI_API_KEY&#124;api\.x\.ai&#124;xAI)\b[^\r\n]{0,80}?\b([A-Za-z0-9._-]{20,160})\b&#124;\b(xai[-_][A-Za-z0-9_-]{20,160})\b
```

--------------------------------

### Vapi API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a Vapi API key. The regex is case-insensitive and detects Vapi private keys or web tokens, including UUID formats and specific prefixes.

```regex
(?i)\b(?:vapi&#124;vapi_private_key&#124;vapi_web_token)\b[^\r\n]{0,80}?\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b&#124;\b(vapi_private_key_[A-Za-z0-9]{20,128})\b
```

--------------------------------

### Install Secrets Scanner with Claude Code

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/README.md

Use these commands to add the secrets-scanner plugin to your Claude Code environment. 'marketplace add' clones the repo, and 'plugin install' makes the skill available.

```bash
/plugin marketplace add whit3rabbit/secrets-scanner
/plugin install secrets-scanner@whit3rabbit
```

--------------------------------

### Firecrawl API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a Firecrawl API key. The regex specifically matches keys starting with 'fc-' followed by 32 hexadecimal characters.

```regex
\b(fc-[a-fA-F0-9]{32})\b
```

--------------------------------

### Build Node.js Binding Package from Source

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

If no native artifact matches your platform, build the Node.js binding package from a checkout. Navigate to the bindings/node directory and run npm install and npm run build.

```bash
cd bindings/node
npm install
npm run build
```

--------------------------------

### Node Binding Build and Test

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/RELEASE.md

Commands to install dependencies, build, typecheck, and test the Node.js bindings. These must be run from the 'bindings/node/' directory.

```bash
npm install
npm run build && npm run typecheck && npm test
```

--------------------------------

### Mistral AI API Key Detection Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/secrets-scanner.md

Example of a Mistral AI API key. The regex specifically targets the 'mistral_' prefix followed by alphanumeric characters and hyphens.

```regex
\b(mistral_[A-Za-z0-9_-]{20,160})\b
```

--------------------------------

### Alibaba Secret Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Alibaba secret key. This rule is active and uses a regex to detect a 30-character alphanumeric key associated with 'alibaba'.

```regex
(?i)[\w.-]{0,50}?(?:alibaba)(?:[ \t\w.-]{0,20})[\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{30})(?:[\x60'"\s;]|\\[nr]|$) 
```

--------------------------------

### GitHub App Installation Access Token Regex

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies GitHub App installation access tokens, which follow a specific format: ghs_ + numeric ID + underscore + base64 encoded string + dot + base64 encoded string + dot + base64 encoded string.

```regex
(?x)
(
  ghs_[0-9]+_
  [A-Za-z0-9_-]+ \. [A-Za-z0-9_-]+ \. [A-Za-z0-9_-]+
)

```

--------------------------------

### Build with Full Ruleset

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/CLAUDE.md

Build the project with the `--features full-ruleset` flag enabled.

```makefile
make build-full
```

--------------------------------

### Datadog Access Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects Datadog access tokens. The example includes a sample token.

```regex
(?i)[\w.-]{0,50}?(?:datadog)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)["\s=]{0,5}([a-z0-9]{40})(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### MCP Server Startup Options

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node-mcp/README.md

Common startup options for the secrets-scanner-mcp server, including file size, file count, and finding limits.

```bash
rsecrets-scanner-mcp \
  --root .
  --max-file-size 2097152 \
  --max-files 5000 \
  --max-findings 1000 \
  --max-findings-per-file 100
```

--------------------------------

### Kingfisher Aikido Secret Rule Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects Aikido secret keys starting with 'AIK_SECRET_' followed by 64 alphanumeric characters.

```regex
(?x)
\b
(
  AIK_SECRET_[A-Za-z0-9]{64}
)
\b

```

--------------------------------

### Build and Run Docker Image

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Build a Docker image for local use or non-GitHub CI. Run the scanner against the current directory mounted into the container.

```bash
docker build -t secrets-scanner:dev .
docker run --rm -v "$PWD:/repo" secrets-scanner:dev scan /repo --git-tracked
```

--------------------------------

### Kingfisher AGE Secret Key Rule Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects AGE secret keys starting with 'AGE-SECRET-KEY-PQ-' followed by 58 alphanumeric characters.

```regex
(?x)
\b
(
  AGE-SECRET-KEY-PQ-1[0-9A-Z]{58}
)
\b

```

--------------------------------

### Release Steps: Update Versions and Lockfiles

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/RELEASE.md

Execute these commands to update all version locations, refresh lockfiles for the root, Node.js bindings, and WebAssembly bindings before a release.

```bash
# 1. Bump all version locations + CHANGELOG (see tables above), refresh lockfiles:

```

```bash
cargo check                                  # syncs root Cargo.lock

```

```bash
( cd bindings/node && cargo check )          # syncs node Cargo.lock

```

```bash
( cd bindings/wasm && cargo update -p rsecrets-scanner-wasm --precise vX.Y.Z )  # syncs wasm Cargo.lock

```

--------------------------------

### Discord API Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects Discord API tokens. The example includes a sample token.

```regex
(?i)[\w.-]{0,50}?(?:discord)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)["\s=]{0,5}([a-f0-9]{64})(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### Clippy with All Targets and Warnings

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/CLAUDE.md

Run clippy with all targets and fail on any warnings. This is more comprehensive than the default `make ci` clippy command.

```rust
cargo clippy --all-targets -- -D warnings
```

--------------------------------

### Kingfisher Adobe P8e Rule Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects Adobe P8e API keys, which start with 'p8e-' followed by 32 alphanumeric characters and hyphens.

```regex
(?xi)
\b
(
  p8e-[A-Z0-9-]{32}
)
(?:[^A-Z0-9-])

```

--------------------------------

### Databricks API Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects Databricks API tokens. The example shows a typical token format.

```regex
\b(dapi[a-f0-9]{32}(?:-\d)?)(?:[\x60'"\s;]|\\[nr]|$)`
```

--------------------------------

### Benchmark Script

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/CLAUDE.md

Reproduce the README runtime-ruleset table using a benchmark script. This script self-bootstraps a benign corpus and is portable across BSD/GNU time.

```shell
CORPUS=<dir> scripts/benchmark.sh "label\|rules.toml" ...
```

--------------------------------

### Build secrets-scanner from Source

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node/README.md

If the bundled artifact does not match your platform (e.g., musl/Alpine Linux), clone the repository, navigate to the bindings directory, and build from source. This process generates the native addon file.

```bash
git clone https://github.com/whit3rabbit/secrets-scanner.git
cd secrets-scanner/bindings/node
npm install
npm run build
npm test
```

--------------------------------

### Initialize Lite Ruleset Scanner

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/wasm/FUTURE.md

This API provides a lighter ruleset for the scanner, which can reduce memory and startup time. It should not be used as a silent replacement for Scanner.bundled().

```javascript
const scanner = Scanner.lite();
```

--------------------------------

### Release Steps: Tag and Push for Publication

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/RELEASE.md

Tag the release commit and push the tag to the remote repository to publish the new version. This action is irreversible.

```bash
# 4. Tag and push (this publishes — irreversible):

```

```bash
git tag -a vX.Y.Z -m "Release vX.Y.Z"

```

```bash
git push <remote> vX.Y.Z

```

--------------------------------

### DroneCI Access Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects DroneCI access tokens. The example shows a typical token format.

```regex
(?i)[\w.-]{0,50}?(?:droneci)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)["\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### Instantiate Scanner from Rules File

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node/README.md

Use Scanner.fromRulesFile() to load a TOML rules file from the disk.

```js
Scanner.fromRulesFile(path, config?)
```

--------------------------------

### Run Full Local Gate

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/CLAUDE.md

Execute the full local gate, including formatting, clippy linting, tests, rule drift/validation, and a full build.

```makefile
make ci
```

--------------------------------

### Build with Full Ruleset

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Build the secrets-scanner with the 'full-ruleset' feature enabled, which includes the secrets-patterns-db.

```bash
cargo build --release --features full-ruleset
```

--------------------------------

### Instantiate Scanner with Bundled Rules

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node/README.md

Use Scanner.bundled() when deterministic compile-time bundled rules are desired.

```js
Scanner.bundled(config?)
```

--------------------------------

### Node Bindings Linting and Testing

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/CLAUDE.md

Commands to run formatting, clippy, and tests specifically within the node bindings directory. These are separate from the root project commands.

```shell
cd bindings/node/

cargo fmt

clippy --all-targets -- -D warnings

cargo test

npm run build && npm run typecheck && npm test
```

--------------------------------

### List and View GitHub Release Runs

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/RELEASE.md

Find recent release and publish runs, then view job details including conclusions and names.

```bash
gh run list --limit 5                         # find the Release + Publish runs
gh run view <id> --json jobs --jq '.jobs[] | "\(.conclusion)\t\(.name)"'
```

--------------------------------

### Add and Install Claude Code Plugin

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Adds the secrets-scanner plugin to the Claude Code marketplace and then installs it. This enables Claude to manage the scanner.

```bash
/plugin marketplace add whit3rabbit/secrets-scanner
/plugin install secrets-scanner@whit3rabbit
```

--------------------------------

### Release Steps: Commit and Push to Main

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/RELEASE.md

After updating versions and lockfiles, commit the changes to the main branch and push them to the remote repository.

```bash
# 3. Commit to main and push:

```

```bash
git commit -am "Release vX.Y.Z: …"

```

```bash
git push <remote> main

```

--------------------------------

### Install Secrets Scanner with Codex from Checkout

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/README.md

Commands to install the secrets-scanner plugin when working from a local checkout with Codex. The plugin manifest is located at .codex-plugin/plugin.json.

```bash
codex plugin marketplace add .agents/plugins
codex plugin add secrets-scanner@whit3rabbit
```

--------------------------------

### Instantiate Scanner with Default Rules

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node/README.md

Use Scanner.fromDefaultRules() to match the CLI's rule lookup behavior.

```js
Scanner.fromDefaultRules(config?)
```

--------------------------------

### Clone and Build Secrets Scanner

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Clone the repository and build the debug binary. Use --features flags to include specific functionalities like the runtime updater or the full ruleset.

```bash
git clone https://github.com/whit3rabbit/secrets-scanner.git
cd secrets-scanner

cargo build

cargo build --features updater

cargo build --features full-ruleset

cargo build --release
```

--------------------------------

### Various Git Scan Modes

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node/README.md

Demonstrates different configurations for scanning Git repositories. These options allow for scanning tracked files, staged files, changed files against a base branch, or the entire Git history.

```javascript
Scanner.fromDefaultRules({ gitTracked: true }).scanPath(".");
Scanner.fromDefaultRules({ gitStaged: true }).scanPath(".");
Scanner.fromDefaultRules({ changedFiles: true, base: "origin/main" }).scanPath(".");
Scanner.fromDefaultRules({ gitHistory: true, historyAll: true }).scanPath(".");
```

--------------------------------

### Run Developer Workflow Commands

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Execute common development tasks such as running tests, lints, and format checks using the provided Makefile.

```bash
# Run the automated test suite
make test

# Run Clippy lints
make clippy

# Run rustfmt format checks
make fmt-check

# Run full CI suite (combines build, test, lint, and ruleset checks)
make ci
```

--------------------------------

### Build Optimized Release Binary

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Build the optimized release binary for the secrets-scanner project.

```bash
cargo build --release
```

--------------------------------

### Build WASM Package

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/wasm/README.md

Builds the WebAssembly package for browser targets.

```sh
npm run build --prefix bindings/wasm
```

--------------------------------

### Initialize and Scan Content

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/wasm/README.md

Initializes the WASM module and scans the provided content for secrets using the bundled scanner.

```js
import init, { Scanner } from "@whit3rabbit/rsecrets-scanner-wasm";

await init();

const scanner = Scanner.bundled();
const findings = scanner.scanContent(
  "input.env",
  "export TOKEN=ghp_n0tArEaLsEcReTgHuBpAt1234567890AbCde"
);
```

--------------------------------

### Download Latest Upstream Rules

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Use this script to download the latest upstream gitleaks rules. Alternatively, use the Makefile target.

```bash
# Download latest upstream rules
./scripts/update_rules.sh
```

```bash
# Or via Makefile
make update-rules
```

--------------------------------

### Airtable API Key Example

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Example of an Airtable API key. This rule is active and uses a regex to identify keys associated with 'airtable', typically 17 characters long.

```regex
(?i)[\w.-]{0,50}?(?:airtable)(?:[ \t\w.-]{0,20})[\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{17})(?:[\x60'"\s;]|\\[nr]|$) 
```

--------------------------------

### DocuSign Secret Key Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies DocuSign secret keys, which are GUIDs. The pattern looks for 'docusign' followed by optional characters and then 'secret_key' or similar keywords, preceding a GUID. This pattern is case-insensitive.

```regex
(?xi)
\b
docusign
(?:.&#124;[\n\r]){0,64}?
\b(?:secret[_-]?key&#124;ds[_-]?secret&#124;secret)\b
(?:.&#124;[\n\r]){0,16}?
[=:"'\s]
['"]*
(<br>
  [a-f0-9]{8}-
  [a-f0-9]{4}-
  [a-f0-9]{4}-
  [a-f0-9]{4}-
  [a-f0-9]{12}
)<br>
\b

```

--------------------------------

### Pepipost/Netcore API Key Pattern

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/spdb.md

Identifies API keys for Pepipost or Netcore. Matches the prefix 'pepipost' or 'netcore', followed by up to 40 characters and a 32-character alphanumeric key.

```regex
(?:pepipost&#124;netcore).{0,40}\b([a-zA-Z-0-9]{32})\b
```

--------------------------------

### List Rules Subcommand

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Command to list all loaded rules, optionally from a specified TOML file.

```bash
list-rules      List all loaded rules
  [--rules <PATH>] List all rules from a TOML file or default rules
```

--------------------------------

### Docker Swarm Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies Docker Swarm manager and worker tokens. Manager tokens start with 'SWMTKN-1-' followed by a 50-60 character alphanumeric string and a 24-30 character alphanumeric string. Worker tokens are similar but start with 'SWMKEY-1-'.

```regex
(?x)
\b
(
  SWMTKN-1-[a-z0-9]{50,60}-[a-z0-9]{24,30}
)
\b

```

```regex
(?x)
\b
(
  SWMKEY-1-[A-Za-z0-9+/]{40,50}
)
\b

```

--------------------------------

### Run MCP server wrapper

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Runs the Node.js MCP wrapper for secrets-scanner, specifying the project root directory.

```bash
npx -y @whit3rabbit/rsecrets-scanner-mcp --root /path/to/project
```

--------------------------------

### Docker Hub Access Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects Docker Hub Personal Access Tokens (PATs) and OAuth Access Tokens (OATs). PATs start with 'dckr_pat_' followed by 27 URL-safe base64 characters. OATs start with 'dckr_oat_' followed by 32 URL-safe base64 characters. These patterns are case-insensitive.

```regex
(?xi)
\b
(<br>
  dckr_pat_[A-Z0-9_-]{27}<br>
)<br>
(?: $ &#124; [^A-Z0-9_-] )

```

```regex
(?xi)
\b
(<br>
  dckr_oat_[A-Z0-9_-]{32}<br>
)<br>
(?: $ &#124; [^A-Z0-9_-] )

```

--------------------------------

### Clippy with Features and All Targets

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/CLAUDE.md

Run clippy with specific features enabled and all targets, ensuring comprehensive linting for feature-gated code.

```rust
cargo clippy --features updater --all-targets
```

--------------------------------

### Uninstall native pre-commit hook

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Uninstalls the native git pre-commit hook installed by secrets-scanner.

```bash
bash "$SKILL_DIR/scripts/uninstall-git-hook.sh"
```

--------------------------------

### Planview LeanKit/Planview API Key Pattern (128 chars)

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/spdb.md

Identifies Planview LeanKit or Planview API keys. Matches the prefix 'planviewleankit' or 'planview', followed by up to 40 characters and a 128-character hexadecimal key.

```regex
(?:planviewleankit&#124;planview).{0,40}\b([0-9a-f]{128})\b
```

--------------------------------

### Detect Xata Secret

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Matches Xata secrets, which start with 'xau_' followed by a 33-character alphanumeric string.

```regex
(?x)
\b
( 
  xau_[A-Za-z0-9]{33}
)
\b

```

--------------------------------

### Postmark API Token Regex

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies Postmark API tokens, which start with 'postmark' and contain a UUID.

```regex
(?xi)
postmark [a-z0-9_-]{0,20}
.{0,10}
\b
(
  [a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}
)
\b

```

--------------------------------

### PostHog API Key Regex (phr)

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects PostHog real-time API keys starting with 'phr_'.

```regex
(?x)
(
  phr_[A-Za-z0-9]{40,43}
)

```

--------------------------------

### MCP Server History Scanning Options

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node-mcp/README.md

Specific startup options for enabling and configuring git history scanning in the secrets-scanner-mcp server.

```bash
rsecrets-scanner-mcp \
  --root .
  --enable-history \
  --history-timeout-secs 30 \
  --history-log-opt "--since=30 days ago"
```

--------------------------------

### PostHog API Key Regex (pha)

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies PostHog authentication API keys starting with 'pha_'.

```regex
(?x)
(
  pha_[A-Za-z0-9]{40,43}
)

```

--------------------------------

### Planview LeanKit/Planview API Key Pattern (subdomain)

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/spdb.md

Detects Planview LeanKit or Planview API keys that include a subdomain. Matches the prefix 'planviewleankit' or 'planview', followed by up to 40 characters, 'subdomain', and a valid domain name.

```regex
(?:planviewleankit&#124;planview).{0,40}(?:subdomain).\b([a-zA-Z][a-zA-Z0-9.-]{1,23}[a-zA-Z0-9])\b
```

--------------------------------

### PostHog API Key Regex (phs)

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects PostHog server-side API keys starting with 'phs_'.

```regex
(?x)
(
  phs_[A-Za-z0-9]{44,48}
)

```

--------------------------------

### PostHog API Key Regex (phx)

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies PostHog client-side API keys starting with 'phx_'.

```regex
(?x)
(
  phx_[A-Za-z0-9]{44,48}
)

```

--------------------------------

### Detect OpenVSX Token

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies OpenVSX extension tokens. They start with 'ovsxat_' or 'ovsxp_' followed by a UUID.

```regex
(?x)<br>\b<br>(<br>  (?:ovsxat&#124;ovsxp)_[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}<br>)<br>\b<br>
```

--------------------------------

### Run MCP server wrapper with history enabled

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/plugins/secrets-scanner/skills/secrets-scanner/SKILL.md

Runs the Node.js MCP wrapper for secrets-scanner, enabling the scan of git history.

```bash
npx -y @whit3rabbit/rsecrets-scanner-mcp --root /path/to/project --enable-history
```

--------------------------------

### Detect 1Password Secret

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies 1Password secrets. These often start with 'ops_eyj' followed by a base64-encoded string.

```regex
(?xi)\b
(ops_eyj[A-Za-z0-9_-]{80,500})
\b

```

--------------------------------

### Jina Secret Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies Jina secrets, which start with 'jina_' followed by 60 alphanumeric characters.

```regex
(?x)
\b
(
  jina_[a-zA-Z0-9]{60}
)
\b

```

--------------------------------

### Ionic Secret Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies Ionic secrets, which start with 'ion_' followed by 42 alphanumeric characters.

```regex
(?x)
\b                     
(
  ion_
  [a-zA-Z0-9]{42}
)
\b

```

--------------------------------

### Detect CodeRabbit Secrets

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies CodeRabbit secrets, which start with 'cr-' followed by 58 alphanumeric characters.

```regex
(?x)
\b
(
  cr-[a-fA-F0-9]{58}
)
\b

```

--------------------------------

### Detect ThingsBoard Provision Device Keys

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Finds ThingsBoard device provision keys, which are 20-character alphanumeric strings associated with the 'provisionDeviceKey' field. Case-insensitive matching.

```regex
(?x)<br>"provisionDeviceKey"\s*:\s*"(<br>  [a-z0-9]{20}<br>)<br>\b<br>
```

--------------------------------

### Detect Checio Secret

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/spdb.md

Identifies Checio secrets starting with 'pk_' followed by 45 alphanumeric characters.

```regex
(?:checio).{0,40}\b(pk_[a-z0-9]{45})\b
```

--------------------------------

### Dropbox API Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects Dropbox API tokens. The example shows a typical token format.

```regex
(?i)[\w.-]{0,50}?(?:dropbox)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)["\s=]{0,5}([a-z0-9]{15})(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### GitLab CI Integration

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/README.md

Example configuration for GitLab CI to use the secrets-scanner Docker image. Scans the repository and saves results as an artifact.

```yaml
secrets-scan:
  image: secrets-scanner:dev   # or a registry tag you build/push
  script:
    - secrets-scanner scan . --git-tracked --format sarif --output gl.sarif
  artifacts:
    when: always
    paths: [gl.sarif]
```

--------------------------------

### Import and Use Scanner in TypeScript

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/bindings/node/README.md

Import Scanner and ScanResult types in TypeScript, then instantiate and use the scanner.

```ts
import { Scanner, type ScanResult } from "@whit3rabbit/rsecrets-scanner";

const scanner = Scanner.bundled();
const result: ScanResult = scanner.scanContentDetailed("input.txt", "hello");
```

--------------------------------

### Discord Client Secret Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects Discord client secrets. The example shows a typical secret format.

```regex
(?i)[\w.-]{0,50}?(?:discord)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)["\s=]{0,5}([a-z0-9=_\-]{32})(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### Discord Client ID Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects Discord client IDs. The example shows a numerical ID format.

```regex
(?i)[\w.-]{0,50}?(?:discord)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\\|\||:|=>|\?=|,)["\s=]{0,5}([0-9]{18})(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### DigitalOcean Refresh Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects DigitalOcean refresh tokens. The example shows a typical token format.

```regex
(?i)\b(dor_v1_[a-f0-9]{64})(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### Rust Formatting, Linting, and Testing

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/RELEASE.md

Commands to check Rust code formatting, run clippy with strict warning checks, and execute all tests. These are part of the pre-release gate for Rust components.

```bash
cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo test
```

--------------------------------

### Run Local Scan

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/CLAUDE.md

Execute a local scan on git-tracked files.

```rust
cargo run -- scan <path> --git-tracked
```

--------------------------------

### DigitalOcean Access Token Detection

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/gitleaks.md

Detects DigitalOcean access tokens. The example shows a typical token format.

```regex
\b(doo_v1_[a-f0-9]{64})(?:[\x60'"\s;]|\\[nr]|$)
```

--------------------------------

### LaunchDarkly SDK Key Pattern

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Detects LaunchDarkly SDK keys, used for client-side integration with the LaunchDarkly feature flagging service.

```regex
(?xi)
launchdarkly
(?:. |[\n\r]){0,32}?
\b
( 
  [a-z0-9_\-=]{40}
)

```

--------------------------------

### Detect WorkOS API Key

Source: https://github.com/whit3rabbit/secrets-scanner/blob/main/docs/rulesets/kingfisher.md

Identifies WorkOS API keys, starting with 'workos' and a live key pattern.

```regex
(?x)
\b
(?i:workos)
(?:. |[

]){0,24}?
\b
( 
  sk_live_a2V5Xz[A-Za-z0-9+/]{69}={0,2}
)
(?:[^A-Za-z0-9+/=]|$) 

```
Tokens:
Raw