Scan Git commit history for high-entropy secrets

reposcanner reads through every commit in a Git repository and looks for strings that resemble secrets, such as API keys, tokens, and passwords. A secret deleted from the current tree still lives in history, so a tool that only scans the latest checkout misses it. reposcanner walks past commits to catch credentials that were committed once and reverted later.

Detection rests on Shannon entropy plus line-length rules. You set a minimum entropy threshold with -e and a maximum line length with -l, and reposcanner flags lines whose randomness crosses the bar. Bound the scan to a single branch with -b or to a fixed number of recent commits with -c when a full-history pass is too slow.

On Trickest, reposcanner is a Static Code Analysis node that takes a repository reference and writes a file and a folder of findings. Run it across a set of organization repositories to surface credential leaks before an attacker pulls the same history.