dsh-secret-scan

In fast-paced, multi-developer environments, accidentally committing sensitive credentials is one of the most common security incidents: a stray AWS Secret Key, an OpenAI API token, or a PEM private key left in a diff can lead to account hijacking or data breaches within hours. Pre-commit hooks and CI checks often have blind spots, and manually grepping a large codebase is painfully slow.

dsh-secret-scan is a pure Node.js, zero-network, zero-dependency scanner that recursively walks a directory tree using high-precision heuristic regexes. It recognises over a dozen credential types — AWS access/secret keys, GitHub and npm tokens, OpenAI keys, Stripe live keys, Google API keys, Slack tokens, JWTs, PEM private keys, hardcoded passwords, and generic API tokens. Results report only the file path, line number, detected type, and severity level; the actual secret value is never echoed. The scanner automatically skips node_modules, .git, dist, binary files, and lock files to keep noise low.

It is well suited for solo developers who want a quick pre-commit sanity check, and for small-to-mid teams that want to embed a lightweight screening step in their code-review pipeline. As a heuristic regex scanner it does not guarantee zero false positives and does not attempt auto-remediation; its job is to flag suspicious locations with high recall and zero plaintext exposure, leaving final judgment and fixes to humans.