Source Review
Secret Scanner
A local orchestrator that runs multiple secret-detection engines and turns their results into consistent evidence and summaries.
What it does
Secret Scanner coordinates Gitleaks, Betterleaks, TruffleHog, and Titus across complete Git history or filesystem trees. It preserves each scanner’s raw evidence while producing redacted normalized CSV and JSON summaries.
Why it exists
Different scanners find different things and use different output formats. I wanted to preserve each raw report while producing a common set of fields for review and comparison.
Local-first handling
Scanning and normalization happen locally. Output directories and files use owner-only permissions on supported systems, and spreadsheet-bound CSV fields are protected against formula injection. Raw reports may still contain live credentials and should be treated as sensitive assessment evidence. Verification is deliberately opt-in because network-active validation can contact third parties, create audit events, or change the evidence-handling profile of a scan. Incomplete scanner coverage produces a nonzero exit status instead of looking like a clean result.
Limitations
- The underlying scanners must be installed separately.
- Results still require human validation and context.
- Live verification can create outbound traffic and should only be enabled deliberately.
- Native scanner reports remain unredacted even when the normalized findings are redacted.