Detection rules

Built-in rules run against every staged file's content. Matches are redacted in output (e.g. AKIA****************WXYZ) — the real value is never printed in full.

Built-in coverage

• AWS — Access Key IDs
• GitHub / GitLab — personal access tokens
• Slack — bot/user tokens and incoming webhook URLs
• Google — API keys
• Stripe — live secret keys
• Twilio / Mailgun / SendGrid — API keys
• npm — automation/publish tokens
• Private keys — -----BEGIN ... PRIVATE KEY----- blocks (RSA, EC, OpenSSH, PGP, etc.)
• JWTs — signed JSON Web Tokens
• Database connection strings — URIs with embedded credentials (e.g. postgres://user:pass@host/db)
• Generic assignments — api_key = "..." / password = "..." style key-value pairs

This list evolves; see the Changelog for what's new per release.

Turning a rule off

Disable a specific rule repo-wide via .secretcheckrc.json:

{
  "disableRules": ["generic-api-key"]
}

See Configuration for the full set of ways to tune detection — disabling a rule, ignoring paths, inline disables, and adding your own patterns.