6 Tools That Make Up a Local-First Security Stack (All Free)

The local-first security stack consists of six tools, all of which are free. The main idea behind this stack is that the security workflow runs on the machine itself, not in a remote service. This allows it to function effectively in restricted environments such as air-gapped builds and compliance reviews, and it isn't dependent on vendor uptime or subscription renewals.

The stack is not a product, but rather a set of habits with the proper tools attached. These habits are what endure regardless of the tool chosen, as tools change over time while habits accumulate.

The first tool in the stack is the scanner, responsible for finding potential candidates, which serves as the detection layer. The second tool is the pre-push hook, acting as the early warning layer, checking before a secret reaches the remote. The third tool is the CI gate, the enforcement layer that runs on every push from every machine.

The fourth tool is the rotation checklist, the response layer that transforms a finding into a dead key. The fifth tool is the history audit, a quarterly deep clean of files that ever contained the pattern. Lastly, the sixth tool is the report archive, responsible for keeping JSON reports over time to show trends.

The scanner reads various files, including environment files, config files in common formats, compose files, JSON configs, and source code. It skips directories defined as noise, such as dependency folders, build output, and lockfiles, as these are typically audited separately and are not the source of truth. This scan is quick and efficient, covering 1000+ files in seconds. The skip list helps optimize the scan in monorepos, making the scan fast and effective.

The scanner covers files present in the worktree, catching obvious cases like recently created and to-be-committed files. For subtler cases, such as secrets already in history, it combines version control system tools to find files that ever contained the pattern, then scans them. This ensures that a committed secret doesn't stop being a secret when deleted from the current branch, as it lives in every clone, fork, and mirror.

The scanner was created after an audit of public repositories revealed three leaked secrets, with the most concerning being a production database password that had been committed in plaintext for eight months. Most leaks are silent and go unnoticed until the rotation happens by accident. A scanner is not an optional luxury for teams with a security budget; it is a crucial tool, similar to a spellchecker. It is cheap, automatic, and the only thing standing between a careless commit and a security incident.