nosecretsv0.3.8nosecrets.casoon.de

CASOON Open Source

Catch secrets before they become commits.

An API key pasted into a config file is easy to commit and hard to take back: once it is in Git history, the only fix is to rotate it. nosecrets checks what you are about to commit, on your own machine, and stops the commit if it finds a password, token or key.

curl -fsSL https://raw.githubusercontent.com/casoon/nosecrets/main/install.sh | sh
npm install -g @casoon/nosecrets
cargo install nosecrets-cli
Free · MITv0.3.8offlinemacOS · Linux · Windows
Terminal: config.py holds the example keys from the AWS documentation. After git add config.py, nosecrets scan --staged reports 'config.py:3:26 [CRITICAL] AWS Secret Access Key (aws-secret-key)' with the masked preview wJal...EKEY and exits with 1; the example key ID ending in EXAMPLE is not reported. With the secret key read from the environment instead, the same scan prints 'No secrets found' and exits with 0.

Who it is for

  1. Developers who commit config

    You work with .env files, deploy settings and API clients, and want a safety net for the day a real key slips into a commit.

  2. Teams and open-source maintainers

    One hook in the repository protects every contributor, without an account, a service or a dashboard to look after.

  3. Before the commit, not after

    nosecrets looks at exactly what the next commit would contain. Nothing reaches the history, so there is nothing to clean up.

  4. Exceptions you can review

    A test value or a documented example can be allowed on purpose. Every exception sits in a file in the repository, visible in code review.

built-in rules for cloud, code hosts, databases and payment
50
extra check for unknown high-entropy tokens
1
network calls while scanning
0
ways to install: curl, npm, cargo
3

How it works

You add nosecrets to the pre-commit hook. On every git commit it reads the files staged for that commit, checks them for known secret formats and suspicious random tokens, and leaves out anything you marked as intentional.

If a secret is left, the commit stops and you see the file, the line and the kind of secret. Everything runs locally: no code is uploaded and no provider is contacted.

How nosecrets worksYou run git commit. The pre-commit hook starts nosecrets, which reads the files staged for this commit from the Git index and checks them against 50 built-in rules and an entropy check, leaving out the exceptions you recorded. If a secret is left, the commit is stopped with exit code 1; otherwise it goes on with exit code 0.How nosecrets worksgit commit → Staged files: pre-commit hookStaged files → 50 rules + entropy50 rules + entropy → Secret left?Secret left? → Commit stopped: yesSecret left? → Commit goes on: nopre-commit hookyesnogit commitgit commitStaged files – from the Git indexStaged filesfrom the Git index50 rules + entropy – minus your exceptions50 rules + entropyminus your exceptionsSecret left?Secret left?Commit stopped – exit code 1Commit stoppedexit code 1Commit goes on – exit code 0Commit goes onexit code 0
How nosecrets worksYou run git commit. The pre-commit hook starts nosecrets, which reads the files staged for this commit from the Git index and checks them against 50 built-in rules and an entropy check, leaving out the exceptions you recorded. If a secret is left, the commit is stopped with exit code 1; otherwise it goes on with exit code 0.How nosecrets worksgit commit → Staged files: pre-commit hookStaged files → 50 rules + entropy50 rules + entropy → Secret left?Secret left? → Commit stopped: yesSecret left? → Commit goes on: nopre-commit hookyesnogit commitgit commitStaged files – from the Git indexStaged filesfrom the Git index50 rules + entropy – minus your exceptions50 rules + entropyminus your exceptionsSecret left?Secret left?Commit stopped – exit code 1Commit stoppedexit code 1Commit goes on – exit code 0Commit goes onexit code 0
How nosecrets worksYou run git commit. The pre-commit hook starts nosecrets, which reads the files staged for this commit from the Git index and checks them against 50 built-in rules and an entropy check, leaving out the exceptions you recorded. If a secret is left, the commit is stopped with exit code 1; otherwise it goes on with exit code 0.How nosecrets worksgit commit → Staged files: pre-commit hookStaged files → 50 rules + entropy50 rules + entropy → Secret left?Secret left? → Commit stopped: yesSecret left? → Commit goes on: nopre-commit hookyesnogit commitgit commitStaged files – from the Git indexStaged filesfrom the Git index50 rules + entropy – minus your exceptions50 rules + entropyminus your exceptionsSecret left?Secret left?Commit stopped – exit code 1Commit stoppedexit code 1Commit goes on – exit code 0Commit goes onexit code 0
How nosecrets worksYou run git commit. The pre-commit hook starts nosecrets, which reads the files staged for this commit from the Git index and checks them against 50 built-in rules and an entropy check, leaving out the exceptions you recorded. If a secret is left, the commit is stopped with exit code 1; otherwise it goes on with exit code 0.How nosecrets worksgit commit → Staged files: pre-commit hookStaged files → 50 rules + entropy50 rules + entropy → Secret left?Secret left? → Commit stopped: yesSecret left? → Commit goes on: nopre-commit hookyesnogit commitgit commitStaged files – from the Git indexStaged filesfrom the Git index50 rules + entropy – minus your exceptions50 rules + entropyminus your exceptionsSecret left?Secret left?Commit stopped – exit code 1Commit stoppedexit code 1Commit goes on – exit code 0Commit goes onexit code 0
How it works in detailExceptions and configuration

Quickstart

Check the repository once, then let the hook check every commit.

  1. Install nosecrets with one of the lines above.
  2. Run nosecrets scan --tracked once and review what it finds.
  3. Add nosecrets scan --staged to your pre-commit hook.
Read the documentation
Two commands
nosecrets scan --tracked   # once, for what is already there
nosecrets scan --staged    # on every commit, in the hook