SecretGuard — Git Secret Scanner

Real-time secret & API key detection for VS Code — before you commit, before it's too late.

Install from Marketplace · GitHub · Report a Bug

Why SecretGuard?

Every day, developers accidentally push API keys, database credentials, and tokens to public repositories. Once a secret is in git history — it's permanent. Deleting the file doesn't help; anyone with git log can recover it.

SecretGuard stops secrets at three layers — before they ever leave your machine:

Features

• Real-time detection — scans as you type with an 800ms debounce; no manual action needed
• Inline diagnostics — red squiggly underlines using the VS Code Diagnostics API, exactly like ESLint
• Sidebar findings panel — lists every detected secret grouped by file; click any finding to jump to that exact line
• Commit blocker — git pre-commit hook prevents git commit if secrets are staged, with redacted output and a rotation link
• Shannon entropy analysis — distinguishes real secrets from placeholders like YOUR_API_KEY_HERE
• Git history audit — scans the last 500 commits for previously leaked secrets
• Export reports — one-click HTML or JSON scan report
• Auto-gitignore — automatically adds flagged sensitive files to .gitignore
• Status bar indicator — shield icon confirms SecretGuard is actively running

What It Detects

30+ Secret Patterns

25+ Sensitive Filenames

.env  .env.local  .env.production     → Always flagged
id_rsa  id_ed25519                    → SSH private keys
*.pem  *.p12  *.pfx                   → Certificate files
credentials.json  *service-account*   → GCP / AWS credential files
.vault-token  .netrc  .npmrc          → Auth token files

How It Works

1. Real-time squiggly lines

const stripe_key = "sk_live_aBcDeFgHiJkLmNoPqRsTuV";
//                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
// ⚠ SecretGuard: Stripe Live Secret Key detected
//   Rotate at: https://dashboard.stripe.com/apikeys

2. Sidebar findings panel

SECRETGUARD — FINDINGS
└── 📄 config.js
    ├── 🔴 Stripe Live Secret Key        Line 3
    ├── 🔴 AWS Access Key ID             Line 7
    └── 🟡 Generic Secret Assignment     Line 12
└── 📄 .env
    ├── 🔴 Database URL                  Line 1
    └── 🔴 GitHub PAT                    Line 4

3. Commit blocker

$ git commit -m "add config"

❌ [SecretGuard] ERROR — Stripe Live Secret Key
   File:  config.js:3
   Match: sk_live_****VwXy
   Rotate at: https://dashboard.stripe.com/apikeys

❌ Commit BLOCKED. Fix the issues above, then commit again.

SecretGuard vs. GitHub Push Protection

GitHub Push Protection is your last line of defense. SecretGuard is your first three.

Getting Started

Install from Marketplace

1. Open VS Code
2. Press Ctrl+Shift+X to open Extensions
3. Search SecretGuard
4. Click Install

Install from VSIX

code --install-extension secretguard-git-protect-1.0.1.vsix

Enable the commit blocker

Open the command palette (Ctrl+Shift+P) and run:

SecretGuard: Install Git Pre-commit Hook

Configuration

Open VS Code Settings (Ctrl+,) and search secretguard:

Commands

Ctrl+Shift+P → type SecretGuard:

Testing

Test Suites: 2 passed
Tests:       43 passed ✓

Coverage:
  ✓ AWS key detection + redaction
  ✓ GitHub PAT detection
  ✓ Stripe live / test keys
  ✓ PostgreSQL + MongoDB URLs
  ✓ PEM / SSH key headers
  ✓ Google API key
  ✓ OpenAI + Anthropic keys
  ✓ Slack + Discord webhooks
  ✓ Placeholder suppression (false positives)
  ✓ Custom entropy thresholds
  ✓ Filename blocklist (.env, id_rsa, etc.)

Tech Stack

For architecture details, see ARCHITECTURE.md.

Local Development

# Clone
git clone https://github.com/Dharaneswara-Reddy/secretguard-vscode.git
cd secretguard-vscode

# Install dependencies
npm install

# Build
npm run build

# Run tests
npm test

# Press F5 in VS Code to launch the Extension Development Host

Contributing

Contributions are welcome. To add a new secret pattern:

1. Fork the repository
2. Add your rule to src/rules/contentRules.ts
3. Add a test case to test/scanner.test.ts
4. Open a Pull Request

Known Limitations

License

MIT © 2026 Palle Venkata Dharaneswara Reddy — see LICENSE