NMSecretLens

OPEN SOURCE SECRET DETECTION CLI

漏れる前に、
見つける。

Find secrets
before they leak.

Scan Git history, environment files, CI logs, and Docker layers for credentials and tokens. This Go CLI prioritizes every finding so you can focus on what needs attention.

Install ↓View source ↗

Go CLI ／ MIT License

secretlens scan .
SCANNINGgit history + env files
CRITICAL
GitHub Token.env · line 4
92
HIGH
AWS Access Keyconfig/dev.yaml · line 18
55
2 findingsvalues masked
7scan sources
4severity levels
5output formats

WHY SECRETLENS

One CLI, beyond
the repository.

Choose the right scan scope for the job—from current changes and past commits to traces left in CI and containers.

01

Scan multiple surfaces

Cover Git history, environment files, staged changes, the worktree, CI logs, and Docker layers.

02

Prioritize findings

Score findings using rules, entropy, and file context, then classify them from CRITICAL to LOW.

03

Fit into your workflow

Integrate locally and in CI with exit codes, SARIF, PR comments, baselines, and custom rules.

SCAN SOURCES

Scan exactly where you need.

Use it for everyday pre-commit checks, existing-project audits, or organization-wide reviews.

gitCommit history
envfileEnvironment and config files
stagedStaged changes
worktreeUncommitted changes
cilogGitHub Actions / GitLab CI
dockerImage layers

GET STARTED

Install with one command.

Install the latest version in any environment with Go available.

$go install github.com/nobuo-miura/SecretLens/cmd/secretlens@latest
Default scansecretlens scan .
Pre-commitsecretlens scan --staged --fail-on=HIGH .
CI / SARIFsecretlens scan --all --format=sarif --out=results.sarif .
Read the documentation →macOS · Linux · Windows

SCAN LOCALLY · PRIORITIZE CLEARLY · INTEGRATE WITH CI

Turn hidden secrets into actionable findings.

GitHub Repository ↗