Static Code Analysis
Find leaked secrets across code and Git history
Rule-based secret scanning across text and full Git history.
overview
What noseyparker does
noseyparker applies detection rules to textual data and full Git history, so API keys and tokens removed from the working tree can still surface. Point it at a file, directory, local repo, or remote clone.
Clone with --git-url, sweep a GitHub user or organization via --github-user and --github-organization, raise parallelism with --jobs, and shape matches with --rules and --ignore.
Trickest runs noseyparker as a managed static-analysis node that accepts a file, directory, or Git source and writes matches to a file and folder. Use it for credential leaks, not for SAST-style injection or logic bugs.
use cases
Where noseyparker fits
Scan a repository's full history
Clone a Git repo and scan every commit so secrets that were added and later deleted still surface, not only the ones left in the current tree.
Sweep an organization's repos
Point noseyparker at a GitHub user or organization to enumerate and scan every accessible repository through the API in one run.
Tune detection to the codebase
Supply custom rules and a path-based ignore file so the scan matches your secret formats and skips vendored or generated paths.
Catch leaks before release
Scan a build directory or checkout on a schedule so leaked tokens are flagged and routed to an alert before they ship.
reference
noseyparker inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input-directory | FOLDER | · | Scan the specified directory or local Git repository. |
| input-file | FILE | · | Scan the specified file. |
| git-url | STRING | --git-url | Clone and scan the Git repository at the specified URL. |
| github-organization | STRING | --github-organization | Clone and scan accessible repositories belonging to the specified GitHub organization. |
| github-user | STRING | --github-user | Clone and scan accessible repositories belonging to the specified GitHub user. |
| rules | FILE | --rules | Use custom detection rules from the specified file. |
| ignore | FILE | --ignore | Use custom path-based ignore rules from the specified file. |
| jobs | STRING | --jobs | Use N parallel scanning jobs (default 10). |
Showing key inputs. noseyparker exposes 18 inputs in total.
Full flag reference (18 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| jobs | STRING | --jobs | Use N parallel scanning jobs (default 10). |
| color | STRING | --color | Enable or disable colored output (auto, never, always; default auto). |
| rules | FILE | --rules | Use custom detection rules from the specified file. |
| ignore | FILE | --ignore | Use custom path-based ignore rules from the specified file. |
| git-url | STRING | --git-url | Clone and scan the Git repository at the specified URL. |
| verbose | BOOLEAN | --verbose | Enable verbose output. |
| progress | STRING | --progress | Enable or disable progress bars (auto, never, always; default auto). |
| input-file | FILE | · | Scan the specified file. |
| github-user | STRING | --github-user | Clone and scan accessible repositories belonging to the specified GitHub user. |
| blob-metadata | STRING | --blob-metadata | Choose which blobs record metadata (all, matching, none; default matching). |
| max-file-size | STRING | --max-file-size | Do not scan files larger than the specified size in MiB (default 100). |
| git-clone-mode | STRING | --git-clone-mode | Method used to clone Git repositories (bare, mirror; default bare). |
| github-api-url | STRING | --github-api-url | URL to use for GitHub API access (default https://api.github.com/). |
| snippet-length | STRING | --snippet-length | Bytes of context to include before and after each match (default 256). |
| input-directory | FOLDER | · | Scan the specified directory or local Git repository. |
| rules-directory | FOLDER | --rules | Use custom detection rules from the specified directory. |
| git-blob-provenance | STRING | --git-blob-provenance | Git commit provenance metadata to collect (first-seen, minimal; default first-seen). |
| github-organization | STRING | --github-organization | Clone and scan accessible repositories belonging to the specified GitHub organization. |
example
Run noseyparker
# clone a repo, scan its full history, then print the findingsnoseyparker scan --datastore np.db --git-url https://github.com/example/webapp.git --jobs 8noseyparker report --datastore np.dbScanned 842.19 MiB from 3,410 blobs in 37 seconds (22.6 MiB/s); 9/9 new matches Rule Distinct Groups Total Matches ────────────────────────────────────────────────────────────── GitHub Personal Access Token 2 3 AWS Secret Access Key 1 1 Generic API Key 3 4 Slack Token 1 1 Run the `report` command next to show finding details.guidance
Choosing noseyparker
Use noseyparker when you need leaked secrets in source or Git history, including across a GitHub organization. It is a secret scanner, not a SAST engine, so reach for credentials rather than injection or code-quality flaws.
trufflehog
Secret scanner with credential verification. noseyparker emphasizes rule-based scanning across large histories.
gitleaks
Lightweight Git secret scanner. noseyparker adds GitHub org and user sweeps plus parallel jobs for larger runs.
secretfinder
Pulls secrets from JavaScript files specifically. noseyparker scans full repos and history rather than single JS assets.
faq
noseyparker questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run noseyparker yourself
A repository URL feeds noseyparker, which scans the code and full Git history for secrets and writes the matches as a queryable output.
Facts on this page come from the live Trickest tool library.