Detects hardcoded credentials in your code, reports them in a structured (JSON or
human-readable) format, and — via real git hooks — blocks git commit / git push
when a secret is found, no matter whether the push is triggered from VS Code's Source
Control view, the integrated terminal, or an external terminal.
Features
- Scan on save: every save re-scans the file and updates the Problems panel with
proper severity (Error / Warning / Information), a rule code, and source
Secret Scanner. - Structured reports:
Secret Scanner: Show Reportopens an output channel with a report intext,json, orboth— configurable viasecretScanner.outputFormat. - Workspace-wide scan:
Secret Scanner: Scan Entire Workspacewalks the whole repo (respectingsecretScanner.ignoreGlobs) and produces one aggregate report. - Git hook enforcement (the real blocking mechanism):
Secret Scanner: Install Git Hooksinstalls an actualpre-pushhook (and an optionalpre-commithook) into.git/hooks/. These run as plain Node scripts outside VS Code entirely, so they catch a push regardless of what client/tool initiated it. On block, the offending file, line, column, and rule are printed, and the push/commit is aborted with a non-zero exit code. - Status bar indicator showing the live secret count for the current file.
- Inline suppression for a reviewed false positive: append
// secret-scanner-ignore-line(or// scanner:ignore) to a line. - Severity-aware blocking:
secretScanner.git.minSeverityToBlocklets you block oncritical/highfindings only while still reportingmedium/lowones. - Emergency override:
SECRET_SCANNER_SKIP=1 git pushbypasses the hook for a single command (use sparingly, it's logged to hook output). - Shared team policy: installing hooks writes a
.secretscannerrc.jsonto the repo root. Commit that file so every teammate who installs the hook enforces the same rules.
Why git hooks, not the VS Code Git API?
VS Code's Git extension exposes no cancelable "before push" event — by the time any
push-related event fires, the push has already left the machine. A pre-push hook is the
only mechanism git itself guarantees will run, and will abort the push, before any commits
reach the remote — regardless of which tool (VS Code, CLI, another IDE) triggered it.
Configuration
| Setting | Default | Description |
|---|---|---|
secretScanner.outputFormat |
text |
text, json, or both |
secretScanner.scanOnSave |
true |
Re-scan on every save |
secretScanner.ignoreGlobs |
node_modules, dist, out, lockfiles, test-samples | Paths excluded from scans |
secretScanner.git.blockPush |
true |
Whether the pre-push hook actually blocks |
secretScanner.git.blockCommit |
false |
Whether the pre-commit hook actually blocks (opt-in) |
secretScanner.git.minSeverityToBlock |
medium |
Minimum severity that triggers a block |
secretScanner.git.autoInstallHooks |
true |
Prompt to install hooks the first time a git repo opens |
Development
npm install
npm run compile # or: npm run watch
Press F5 in VS Code to launch an Extension Development Host.
To manually test the scanner logic without the hooks:
node scripts/testScan.js
Ideas for further hardening (not yet implemented)
- Entropy-based detection alongside regex, to catch high-entropy strings that don't
match a known credential format, and to reduce false positives on generic
KEY_VALUE-style matches. - Server-side enforcement (GitHub/GitLab push protection, or a CI job running the same scanner) as a backstop for teammates who haven't installed the local hook, or who clone the repo fresh and push before installing it.
- Quick Fix code actions to redact a detected secret and insert a
process.env.FOOreference in one click. .secretscannerignorefile for path-based allowlisting, separate from inline per-line suppression.- Secret rotation reminders: if a credential match is later removed from tracked files but was previously pushed, flag that it's still live in git history and should be rotated.