I built a secret scanner that tries to answer “is this secret actually live?"
I’ve been building SecretLoop , and it’s now available in Preview on Open VSX. The problem I was trying to solve is pretty simple. You run a secret scanner and get: “Found an API key.” Cool. But then what? Is it still active? Was it already revoked? Is it buried somewhere in Git history? Do I need to rotate it? And how do I actually remove it without manually hunting through the code? SecretLoop…
I've been working on a tool called SecretLoop, which is now in preview on Open VSX. The main issue I aimed to address is straightforward: once a secret scanner identifies an API key, what should you do next? Is it still active? Has it been revoked? Is it hidden within Git history? Do you need to rotate it? And how can you remove it without manually searching through the code? SecretLoop is designed to handle this process: Detect → Verify → Remediate.
The tool scans your working tree, staged files, and Git history, employing over 100 provider rules along with entropy detection. It can verify supported credentials against their respective providers to determine if they are currently active. The findings are displayed directly within VS Code and offer quick fixes for redacting a secret or moving it to a .env file. SecretLoop also supports rotation when the provider API allows it.
The pre-commit and CI/SARIF support further enhance its functionality. The MCP (Model-driven Code Remediation) server is particularly noteworthy. It doesn't incorporate an LLM (large language model) within the scanner. Instead, the scanner generates deterministic findings, which an AI assistant can explain and work with. Credential values are always redacted in MCP responses, and verification is optional and requires explicit human approval before a credential is sent to its provider.
You can try out SecretLoop without installation using the command: npx secretloop scan. To scan Git history, use the command: npx secretloop history. For CI (continuous integration) integration, use the command: npx secretloop scan --format sarif -o results.sarif. Open VSX: SecretLoop – Open VSX. The GitHub repository is available at SecretLoop on GitHub.
At this stage, it's still in the early/preview phase, so I'm more interested in receiving feedback than downloads. If you use tools like gitleaks, TruffleHog, GitGuardian, or GitHub Secret Scanning, I'd particularly appreciate your insights on what happens after these scanners find a secret. That's the aspect I'm striving to enhance.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
