loading
Loading content
loading
Static Code Analysis
Entropy-based secret scan across a Git repository's commit history.
overview
A secret was committed once, then deleted from HEAD. Checkout-only scanners miss it. reposcanner walks past commits so reverted API keys, tokens, and passwords still surface.
Pass -r for the repo, tune -e minimum Shannon entropy and -l max line length, then bound with -c commit count or -b branch when a full-history pass is too heavy.
gitleaks and trufflehog ship larger detector libraries and verification. reposcanner stays entropy-driven. Feed a repository reference; findings land as FILE plus FOLDER for org-wide sweeps.
use cases
Scan the full commit history so credentials that were committed and later deleted still surface, since they remain reachable in past commits.
Point reposcanner at one branch with -b to review a feature line or release branch in isolation rather than the whole repository.
Raise the minimum entropy threshold with -e to focus on high-randomness strings and reduce false positives from ordinary code and config text.
Feed a list of organization repositories through reposcanner so every codebase gets a history-level secret check on a schedule.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| repo | STRING | -r | Repo to scan. |
| count | STRING | -c | Number of commits to scan. Default: all. |
| branch | STRING | -b | Scan a specific branch. |
| length | STRING | -l | Maximum line length. Default: 5. |
| entropy | STRING | -e | Minimum entropy to report. Default: 4.3. |
| verbose | BOOLEAN | -v | Verbose. |
Showing key inputs. reposcanner exposes 6 inputs in total.
example
# scan full history of a public repo for high-entropy secretsreposcanner -r https://github.com/example-org/example-repo -e 4.3 -l 200 -v[+] Scanning https://github.com/example-org/example-repo[+] Branch: main[!] High entropy string found Commit: a1b2c3d4e5f60718293a4b5c6d7e8f901234abcd File: config/settings.py Line: 42 Entropy: 5.12 String: AKIAIOSFODNN7EXAMPLE[!] High entropy string found Commit: 9f3a1c2b7d4e5f60a1b2c3d4e5f6a7b8c9d0e1f2 File: .env.example Line: 8 Entropy: 4.91 String: sk_test_EXAMPLE00000000000000000000guidance
Reach for reposcanner when the target is Git commit history, not just the working tree. Prefer gitleaks or trufflehog when you need a larger ruleset or credential verification.
Rule plus entropy scanner with a large built-in ruleset and git-history support.
Scans history and live sources, then verifies found credentials against providers.
Targets secrets inside JavaScript files, not Git commit history.
faq
related
AST-based security checks for Python source.
Detect hardcoded secrets in git repos and plain directories.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
A repository reference feeds reposcanner, which walks the commit history and writes any high-entropy secrets it finds as a queryable output.
Facts on this page come from the live Trickest tool library.